CVE-2026-63077: JetBrains TeamCity unauthenticated RCE via agent polling deserialization

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS of 9.8, confirmed exploitation via CISA KEV and a very high EPSS score.

What it is

JetBrains TeamCity before 2026.1.3 and 2025.11.7 deserializes untrusted data received through the agent polling protocol, allowing unauthenticated remote code execution. Because the endpoint is reachable without credentials and the flaw is a deserialization issue, any internet-exposed TeamCity server is a high-value target for full compromise.

Impact

An unauthenticated attacker can execute arbitrary code on the TeamCity server, gaining control of the CI/CD host and any credentials, build artifacts and deployment pipelines it manages.

Attack surface

Reached over the network through the agent polling protocol; the CVSS vector shows no privileges and no user interaction required, so no authentication is needed. Exposure depends on whether the TeamCity server or its agent communication port is reachable by the attacker.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2026-08-05 with a remediation due date of 2026-08-08, indicating active exploitation; EPSS gives a 30-day probability of 0.86518 (99.7th percentile). No ransomware campaign use is documented.

What to do

• Upgrade TeamCity to 2026.1.3 or 2025.11.7 (or later) immediately, per the vendor advisory.
• If patching cannot be completed before the CISA due date, restrict network access to the agent polling protocol and the TeamCity web interface to trusted hosts only.
• Isolate the TeamCity server from production networks and limit stored credentials and deployment rights until remediation is verified.
• Review CISA BOD 26-04 guidance and the Forensics Triage Requirements for any required triage or reporting.
• Rotate secrets, tokens and SSH keys accessible to the TeamCity server after patching, in case of prior compromise.

Detection

• Hunt for unexpected or anomalous connections to the TeamCity agent polling port from external or non-agent hosts.
• Review TeamCity server logs for unusual agent registration, polling or deserialization errors around the exposure window.
• Monitor for post-exploitation activity on the TeamCity host such as new processes spawned by the TeamCity service, outbound connections, or new scheduled tasks.
• Check for unexpected changes to build configurations, plugins or credentials that could indicate attacker persistence.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.