CVE-2026-100255
Jetbrains Teamcity ≤ 2025.11.8
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-100255 is a high-severity Improper Validation of Unsafe Equivalence in Input (CWE-1289) vulnerability in Jetbrains Teamcity. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-89999
Vulnerability Data
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.2V9.1.3V10.4.6V2.2.2
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validity checks on information inputs, directly stopping unsafe equivalence validation failures for identifiers and references.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input validation and equivalence checking to prevent this class of flaw.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.26 explicitly lists input validation, integrity checks, resilience against SQL injections/buffer overflows, and related requirements derived from risk assessment; this reaches the unsafe-equivalence validation gap for many (but not all) identifier/reference cases, leaving a bounded remainder such as non-input equivalence checks or unaddressed custom unsafe values.
A.8.27 mandates security-by-design principles including distrust-input, data validation/sanitization, secure design reviews against attack patterns, and zero-trust verification; this reaches a minority slice of unsafe-equivalence validation defects (e.g. explicit authz/equivalence checks) but leaves most instances (e.g. ad-hoc reference handling without those principles) untouched.
Secure coding standards directly require correct validation of resource identifiers and equivalence checks.
Security testing can detect unsafe equivalence flaws but does not prevent them at design time.