A critical unauthenticated remote code execution vulnerability in JetBrains TeamCity has been disclosed with a CVSS 9.8 score. Tracked as CVE-2026-63077, the flaw allows attackers to execute arbitrary code on TeamCity servers without authentication by exploiting a deserialization weakness in the agent polling protocol. If you run TeamCity for CI/CD, this requires immediate action.
Vulnerability Details
CVE-2026-63077 is a deserialization of untrusted data vulnerability (CWE-502) in the TeamCity agent polling protocol. The JetBrains security advisory confirms that unauthenticated remote code execution was possible in TeamCity versions before 2026.1.3, 2025.11.7, and 2024.12.6. The CVSS 3.1 vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network attack vector, low attack complexity, no privileges required, no user interaction, and total impact across confidentiality, integrity, and availability.
The vulnerability was reported to NVD on July 27, 2026, and CISA's ADP analysis on July 27-28 rated it as automatable with total technical impact, though exploitation was assessed as "none" at the time of analysis. Given the critical severity and unauthenticated attack vector, weaponization is expected imminently.
Impact Assessment
TeamCity is a widely deployed CI/CD server used by development teams across industries. A successful exploit grants full remote code execution on the TeamCity server, which typically has elevated access to:
- Source code repositories (GitHub, GitLab, Bitbucket, Azure DevOps)
- Artifact storage (Nexus, Artifactory, S3, Azure Blob)
- Deployment credentials and secrets (cloud provider keys, SSH keys, tokens)
- Build pipelines and deployment configurations
- Container registries and Kubernetes clusters
This creates a direct path to supply chain attacks: compromised build artifacts, injected malicious code, stolen credentials, and lateral movement to production environments. Organizations using TeamCity for production deployments face the highest risk.
Affected Systems
| Version Branch | Affected Versions | Fixed Version |
|---|---|---|
| 2026.1.x | Before 2026.1.3 | 2026.1.3 |
| 2025.11.x | Before 2025.11.7 | 2025.11.7 |
| 2024.12.x | Before 2024.12.6 | 2024.12.6 |
All earlier unsupported versions should be considered vulnerable. JetBrains does not provide patches for end-of-life releases.
Mitigation & Patching
Immediate action required: Upgrade to the patched versions listed above. Download from the official JetBrains TeamCity download page or use your standard update mechanism.
If immediate upgrade is not possible, consider these temporary mitigations:
- Network segmentation: Restrict access to the TeamCity server port (default 8111) to trusted build agent networks and administrative subnets only. Block external access at the firewall.
- Agent authentication: Enforce mutual TLS authentication between agents and server where supported.
- Monitoring: Enable audit logging and alert on anomalous agent registration attempts or unexpected process spawns from the TeamCity service account.
- Isolation: Run TeamCity in a dedicated VM or container with minimal privileges, separate from production systems.
The JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ provides official patch details and download links.
Detection
Security teams should hunt for indicators of compromise:
- Network traffic: Unexpected connections to TeamCity server port (8111) from unknown IPs
- Process anomalies: Unusual child processes spawned by the TeamCity Java process (cmd.exe, powershell.exe, /bin/sh, curl, wget)
- File system changes: New or modified files in TeamCity data directories, especially in build agent work directories
- Log analysis: Review TeamCity server logs for malformed agent polling requests or deserialization errors
CISA's SSVC assessment marks this as "automatable: yes" and "technicalImpact: total," suggesting reliable exploit code will emerge quickly. Prioritize patching over detection.
Frequently Asked Questions
Is TeamCity Cloud affected?
JetBrains TeamCity Cloud is managed by JetBrains and was likely patched before public disclosure. Verify with JetBrains support for your specific instance.
Does this affect build agents?
The vulnerability is in the server's handling of the agent polling protocol. Build agents themselves are not directly affected, but a compromised server can push malicious configurations to agents.
Can I mitigate without upgrading?
Network segmentation and access restrictions reduce exposure but do not eliminate the vulnerability. The deserialization flaw exists in the protocol handling code; any reachable endpoint remains at risk. Upgrade is the only complete fix.
How do I check my TeamCity version?
In the TeamCity web UI, click the gear icon (Administration) → Global Settings → Version. Or check the build.number file in the TeamCity data directory.
What if I'm on an unsupported version?
Upgrade to a supported version immediately. JetBrains does not backport security fixes to end-of-life releases.
Key Takeaways
- CVE-2026-63077 is a critical unauthenticated RCE in JetBrains TeamCity (CVSS 9.8) via deserialization in the agent polling protocol
- Affected: All versions before 2026.1.3, 2025.11.7, 2024.12.6
- Immediate upgrade required — no effective workaround exists
- TeamCity servers often hold keys to CI/CD pipelines, making them high-value supply chain targets
- CISA rates this as automatable with total technical impact — expect weaponization soon
- Network segmentation buys time but does not replace patching
Sources:
- NVD CVE-2026-63077: https://nvd.nist.gov/vuln/detail/CVE-2026-63077
- JetBrains Security Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
- CISA ADP Analysis: CVE-2026-63077 SSVC assessment (July 27-28, 2026)
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.