CVE-2026-63077

This vulnerability lets a malicious person connect to your TeamCity server and make it run attacker-controlled code, without needing a username or password. It’s like someone bypassing the front door and getting full control of the building systems the moment they can reach your office.

This matters if you run JetBrains TeamCity and your TeamCity is reachable over the network, because the agent polling protocol does not require authentication. CISA has listed this issue in KEV, which means you should treat it as a real, time-sensitive risk for systems that can be contacted from the outside. Only a risk if the affected TeamCity instance is reachable over the network (for example, internet-facing, or exposed through your network edge).

This is RED because CISA added CVE-2026-63077 to the KEV catalog (added 2026-08-05), which signals it’s a serious, actionable risk that organizations should address quickly. Since the flaw is unauthenticated remote code execution over the network, an attacker who can reach the service can potentially take over the system; your remediation should be completed by the CISA due date.

1. Confirm exposure and version

• Determine the exact JetBrains TeamCity version running in each environment.
• If the version is before 2026.1.3 (and also before 2025.11.7 on that other fixed line), you are potentially affected.
• Determine whether the TeamCity instance is reachable from the network. Pay special attention to any internet-facing reverse proxy, load balancer, or firewall rule that allows inbound access to TeamCity.

2. Upgrade to the fixed release

• Upgrade TeamCity to the fixed versions provided by the vendor: 2026.1.3 or 2025.11.7 (choose the one that matches your deployed release line/support policy).
• Validate post-upgrade that TeamCity starts correctly and that the relevant agent polling behavior continues to function normally.

3. Interim mitigation if patching is not immediate

• If you cannot upgrade right away, follow JetBrains’ official mitigation guidance for this issue.
• Restrict or disable any network paths related to the agent polling protocol per vendor instructions, especially for any routes that may be accessible without authentication.
• If you have the ability to block inbound access at the edge, restrict inbound traffic to only trusted networks/sources until you can patch.

4. Confirm that exploitation did not already occur

• Review TeamCity logs and the host’s system/application logs around the time windows when suspicious traffic may have occurred.
• Look for evidence of unexpected outbound connections, unusual process execution, or changes to build/project configuration (because the flaw can lead to arbitrary code execution).
• If you find indicators of compromise, escalate to incident response and preserve logs for triage.

5. CISA timing and follow-up

• CISA KEV remediation due date: 2026-08-08.
• Ensure your remediation plan follows CISA guidance (including prioritizing security updates based on asset risk and meeting forensics triage requirements).

6. What to monitor going forward

• Continued attempts of unauthenticated requests to the agent polling-related endpoints.
• Integrity of build artifacts and job configuration.
• Any unexpected new credentials, scheduled tasks, or system changes on the TeamCity host.

Severity/impact: Critical remote code execution (CWE-502) in JetBrains TeamCity; an attacker can run arbitrary code on the server with high impact (confidentiality, integrity, and availability risk).
Mechanism: Unauthenticated remote code execution via the agent polling protocol. No authentication and no user interaction are required per the findings.
Attack vector: Network-based.
Exploitation status: Confirmed as actionable via CISA KEV listing (added 2026-08-05). No dated press claim of exploitation is provided in the findings, and no public exploit code is on record.
EPSS: 0.6% with a flat trend, but this is a prediction and does not override KEV-based urgency.
KEV meaning here: CISA KEV indicates the issue has been recognized as requiring timely mitigation/response; CISA guidance includes applying vendor mitigations and considering exposure/patching prioritization.
Exploit maturity: Real-world exploitation is not described with a dated claim in the provided findings; however, KEV elevates the risk and should be treated as actively relevant for internet-reachable deployments.