CVE-2026-63077 in TeamCity
Summary
by MITRE • 07/27/2026
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability in JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7 represents a critical security flaw that allowed unauthenticated remote code execution through the agent polling protocol. This issue stems from insufficient authentication mechanisms within the communication channel used by build agents to communicate with the TeamCity server. The agent polling protocol is fundamental to TeamCity's distributed build architecture where agents periodically query the server for tasks to execute. When an attacker can exploit this vulnerability without requiring valid credentials, they gain the ability to execute arbitrary code on the TeamCity server, potentially compromising the entire build infrastructure and access sensitive project data.
The technical nature of this flaw falls under CWE-287 which addresses improper authentication issues in software systems. The vulnerability specifically manifests in the agent polling implementation where the protocol does not adequately verify the identity of connecting agents before allowing them to submit or execute commands. This weakness creates an attack surface where malicious actors can forge agent connections and submit crafted payloads that get executed with the privileges of the TeamCity service account. The absence of proper authentication checks during the polling phase means that any system able to reach the TeamCity server's agent endpoint can potentially exploit this vector to gain unauthorized access.
From an operational impact perspective, this vulnerability creates severe risks for organizations relying on TeamCity for continuous integration and deployment processes. Attackers who successfully exploit this issue can execute arbitrary code on the build server, potentially leading to data breaches, system compromise, and disruption of development workflows. The unauthenticated nature of the attack means that even networks with basic firewalls or access controls may be vulnerable if the agent polling endpoint remains exposed to external traffic. Organizations using TeamCity for critical applications face potential exposure of source code repositories, build artifacts, and sensitive configuration data that could be accessed or modified by attackers.
The mitigation strategy involves upgrading to the patched versions 2026.1.3 or 2025.11.7 which implement proper authentication mechanisms for the agent polling protocol. Administrators should also review their network configurations to ensure that the agent polling endpoints are not exposed to untrusted networks and consider implementing additional access controls such as firewall rules or network segmentation. The ATT&CK framework categorizes this vulnerability under T1190 - Exploit Public-Facing Application which emphasizes the importance of securing externally accessible services and maintaining up-to-date software versions. Organizations should also implement monitoring solutions that can detect unusual activity patterns in agent communications, particularly around the polling protocol endpoints, to identify potential exploitation attempts before they result in successful attacks.