CVE-2026-63077: Critical Unauthenticated RCE in JetBrains TeamCity, Already Exploited

CVE-2026-63077: Critical Unauthenticated RCE in JetBrains TeamCity, Already Exploited

In short

JetBrains TeamCity, a widely used platform for automating software integration and deployment (CI/CD), has a critical vulnerability that allows remote code execution without any need for authentication, through the agent polling protocol [1]. It has a CVSS score of 9.8 out of 10 ("critical" severity according to NVD) [1] and appears in CISA's catalog of known exploited vulnerabilities (KEV), confirming that it is already being actively exploited [2]. If your organization uses TeamCity, the priority today is to check the server and agent version and update if applicable.

What it is and why it matters

The vulnerability affects JetBrains TeamCity in versions prior to 2026.1.3 and 2025.11.7 [1]. According to the official description, it allows unauthenticated remote code execution by exploiting the protocol through which build agents "poll" the central server [1]. This is significant because TeamCity is not just any application: it is the server that orchestrates how an organization's software is built, tested, and deployed, with access to repositories, deployment credentials, and production artifacts. Our internal intelligence radar, which relies on this same NVD and CISA KEV catalog data, classifies this case as critical within our "remote code execution" taxonomy [1][2], in line with the severity already assigned by NVD.

Its inclusion in CISA's KEV catalog is a relevant fact in itself: that list captures vulnerabilities with evidence of real, not merely theoretical, exploitation [2]. Based on the verified data we have, we do not have public details about specific campaigns, actors, or attack volume; what is confirmed is its inclusion in KEV as a signal of active exploitation [2].

Who is affected

This affects any organization operating an instance of JetBrains TeamCity on versions prior to 2026.1.3 (2026.x branch) or 2025.11.7 (2025.x branch) [1]. As a CI/CD tool, it is typically deployed by development and DevOps teams, and its compromise can provide access to software build and deployment infrastructure. We do not have verified data on the number of exposed instances or on the type of company most affected, so we avoid speculating on that point.

How to know if you are vulnerable

• Check the installed version of both the TeamCity server and the build agents; if it is earlier than 2026.1.3 or 2025.11.7 depending on the branch, it is affected [1].
• Verify whether the TeamCity server, and in particular the agent polling protocol endpoint (the vector described in the official advisory), is accessible from external networks or the Internet [1].
• Keep in mind that, since it is listed in KEV, this vulnerability should be treated as confirmed exploitation rather than a hypothetical risk when prioritizing [2].

How to protect yourself

1. Update TeamCity to version 2026.1.3, 2025.11.7, or later depending on the branch you use [1].

2. Review server and agent logs for anomalous traffic on the polling protocol, especially since the advisory's publication date, July 27, 2026 [1].

3. If immediate patching is not possible, restrict access to the TeamCity server and the agent polling endpoint to trusted networks or VPNs only.

4. Treat this patch as top priority in the maintenance backlog, given that the vulnerability is listed in CISA's KEV catalog as actively exploited [2].

Frequently asked questions

Does an attacker need credentials to exploit it?

No. The official description states that remote code execution is possible without authentication [1].

Is it actually being exploited, or is it a theoretical risk?

It is confirmed as actively exploited, since it is listed in CISA's KEV catalog [2].

Which versions are safe?

Versions 2026.1.3, 2025.11.7, or later, depending on the TeamCity branch you use [1].

Is updating enough, or is there more to do?

Updating is the essential step. In addition, it is advisable to review logs for any suspicious activity that may have occurred before the patch and to limit the server's exposure while the update is completed [1][2].

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-63077
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json