CVE-2026-59795 is a stored XSS vulnerability (CWE-79) in JetBrains TeamCity versions prior to 2026.1.2. The issue arises from unauthenticated agent registration functionality that allows injection of malicious scripts which are stored and later executed in the context of users accessing the affected system. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. No official patch or remediation level is currently stated, and no known exploits in the wild have been reported.

Successful exploitation could allow an unauthenticated attacker to execute stored malicious scripts in the context of legitimate users, potentially leading to disclosure or modification of sensitive information. The vulnerability impacts confidentiality and integrity but does not affect availability. This could result in unauthorized data access or manipulation within the TeamCity environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor JetBrains advisories for updates. Until a patch is available, consider restricting agent registration or applying compensating controls to limit exposure to unauthenticated registrations.