CVE-2026-63077 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-27

Added to CISA KEV: 2026-08-05 9 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise — this vulnerability is in CISA KEV with confirmed active exploitation. Review TeamCity and web server logs for anomalous agent polling requests, unexpected child processes spawned by the TeamCity process, new/modified build configurations, and unauthorized administrator accounts. Assume all stored secrets/credentials may be compromised.
Immediately upgrade to TeamCity 2026.1.3 or 2025.11.7 (or later). If patching cannot be done immediately, restrict network access to the TeamCity server to trusted IP ranges/VPN only and remove any direct internet exposure.
Rotate ALL secrets, API tokens, SSH keys, SCM credentials, and service account passwords stored in or accessible by TeamCity, as these should be considered exposed. Audit downstream build pipelines and deployed artifacts for tampering (supply-chain integrity).
Deploy WAF/network monitoring for exploitation attempts against the agent polling endpoint and enable continuous EDR monitoring on the server host. Patch priority: EMERGENCY / P1 — patch within 24-48 hours per CISA KEV timeline.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-63077 is a critical remote code execution (RCE) vulnerability affecting JetBrains TeamCity On-Premises, caused by improper handling of data within the agent polling protocol. This vulnerability is highly dangerous because it allows an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication mechanisms and execute arbitrary operating system commands with the privileges of the TeamCity server process, potentially leading to full system compromise and the exposure of sensitive credentials within build pipelines.

Exploitation

Active Exploitation: The vulnerability is currently being actively exploited in the wild, leading the Cybersecurity and Infrastructure Security Agency (CISA) to add it to their Known Exploited Vulnerabilities (KEV) catalog ^[3]^[4].
Threat Actors: While specific named threat actors have not been exclusively linked in available reports, the nature of the exploit and its inclusion in CISA’s KEV catalog indicate it is a target for malicious actors looking to compromise software supply chains.
Exploit Availability: Proof-of-concept (PoC) exploit code is publicly available, including tools that support mass scanning and interactive shell access ^[1].
Attack Prerequisites:

- Network access: An attacker requires network (HTTP/HTTPS) access to the TeamCity server. - Authentication: No authentication is required for exploitation. - User Interaction: No user interaction is necessary.

Affected Products & Patches

Affected Versions: All versions of JetBrains TeamCity On-Premises prior to 2026.1.3 and 2025.11.7 ^[5].
Patches/Fixes: JetBrains has released security updates addressing this issue in versions 2026.1.3 and 2025.11.7. Administrators are urged to upgrade to these or newer versions immediately ^[2]^[6].
Mitigations: If an immediate upgrade is not possible, organizations should restrict network access to the TeamCity server to only trusted IP addresses or internal network segments to minimize the attack surface until the patch can be applied.

Impact

System Access: Successful exploitation grants an attacker the ability to execute arbitrary operating system commands with the privileges of the TeamCity server process, effectively providing full control over the application server.
Business Risk: For internet-facing deployments, this vulnerability poses a severe risk, as it can lead to unauthorized access to sensitive source code, environment variables, build artifacts, and credentials stored within the CI/CD environment, facilitating supply chain attacks and lateral movement into the broader corporate network.

Sources

0xCyp1337/CVE-2026-63077: CVE-2026-63077 - GitHub
CVE-2026-63077 - Unauthenticated RCE exploit for JetBrains TeamCity via Agent Polling Deserialization. Supports mass scanning, multi-threading, and interactive shell. For authorized security testin...
Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077 ...
A critical security vulnerability has been identified in TeamCity On-Premises and assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2026-63077. If exploited, this vulnerability may allow an unauthenticated attacker with HTTP (S) access to a TeamCity server to bypass authenticati…
CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation ...
CISA says attackers are exploiting TeamCity CVE-2026-63077, an unauthenticated RCE flaw that can expose credentials and compromise build pipelines.
CISA Adds One Known Exploited Vulnerability to Catalog
CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability. This type of vulnerability is a frequent attack vector for ...
NVD-CVE-2026-63077
CVE-2026-63077 Detail Description In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol…

🔴 CVE-2026-63077