Vulnerability Description
CVE-2026-63077 (CVSS 9.8, Critical) is an unauthenticated remote code execution vulnerability in the JetBrains TeamCity agent polling protocol, the internal communication channel through which TeamCity build agents check in with the TeamCity server for new build tasks. An unauthenticated attacker can leverage this protocol to execute arbitrary code on the server. Because the agent polling protocol is exposed on the same network interface as the main TeamCity web UI, any Internet-facing server is directly reachable. Successful exploitation would give an attacker control over the build server, including access to source repositories, CI secrets, build artifacts, and any downstream deployment pipelines connected to the server.
| Field | Description |
|---|---|
| CVE-ID | CVE-2026-63077 — CVSS v3.1 9.8 (critical) — assigned by JetBrains |
| Vulnerability Description | CVE-2026-63077 is an unauthenticated remote code execution vulnerability in the JetBrains TeamCity agent polling protocol, allowing an attacker to execute arbitrary code on the TeamCity server without authentication. Because the vulnerable protocol shares a network interface with the main TeamCity web UI, any Internet-facing server is directly exposed. |
| Date of Disclosure | July 27, 2026 |
| Affected Assets | JetBrains TeamCity On-Premises |
| Vulnerable Software Versions | All versions of TeamCity On-Premises prior to 2025.11.7 and 2026.1.3 are affected. TeamCity Cloud instances have already been patched. |
| PoC Available | No public proof-of-concept exploit is known at the time of this investigation. |
| Exploitation Status | JetBrains is not aware of any active exploitation of this vulnerability at the time of publishing. |
| Patch Status | Fixed in TeamCity 2025.11.7 and 2026.1.3. JetBrains has also released a security patch plugin that can be installed on TeamCity 2017.1 and later to patch this specific vulnerability without requiring a full update. |
Censys ARC Perspective
As of July 30, 2026, Censys observes 4,500 TeamCity web properties. Of these, 450 reported one of the patched versions: 2025.11.7 or 2026.1.3. Most remaining observations either reported an earlier release or did not expose a version. Version data alone cannot confirm vulnerability because JetBrains also provides a security plugin that patches CVE-2026-63077 without requiring a full TeamCity upgrade.
From a host-based perspective, TeamCity instances are most commonly seen in cloud and hosting providers like Amazon, Hetzner, and Microsoft, largely within Europe and North America.
The Censys Rapid Response team has notified Censys ARC customers with potentially affected JetBrains TeamCity instances in their attack surfaces.
Censys queries:
host.services.software: (vendor = "jetbrains" and product = "teamcity")
or web.software: (vendor = "jetbrains" and product = "teamcity")
services.software: (vendor = "jetbrains" and product = "teamcity")
ASM:
host.services.software: (vendor = "jetbrains" and product = "teamcity")
or web_entity.instances.software: (vendor = "jetbrains" and product = "teamcity")