CVE-2026-49373 is a vulnerability in JetBrains TeamCity prior to version 2026.1 that permits remote code execution through manipulation of Perforce connection settings. This vulnerability is classified as CWE-88, which involves improper argument injection or modification, potentially allowing attackers with limited privileges to execute arbitrary code remotely without user interaction. The CVSS 3.1 score of 7.1 reflects network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact.

Successful exploitation could allow an attacker with some privileges to execute arbitrary code remotely on the affected TeamCity server, potentially leading to unauthorized access to sensitive data. The vulnerability impacts confidentiality significantly but has limited impact on integrity and no impact on availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor JetBrains advisories closely and consider restricting access to Perforce connection settings or limiting privileges of users who can modify these settings until a patch is available.