internet-facing-service-vulnerabilitywidely-deployed-product-advisoryidentity-authentication-vulnerability

Critical JetBrains TeamCity RCE Enables Unauthenticated OS Command Execution

Vulnerability Disclosure · 23 sources · Updated 2mo ago · First seen Jul 27, 2026

JetBrains disclosed CVE-2026-63077, a critical remote code execution flaw in TeamCity On-Premises that lets unauthenticated attackers with HTTP(S) access abuse the agent polling protocol to bypass authentication and run arbitrary operating system commands. The vulnerability affects TeamCity versions before 2026.1.3 and 2025.11.7, carries a CVSS 3.1 rating of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and is mapped to CWE-502.

JetBrains released fixes in 2025.11.7 and 2026.1.3, and also published a security patch plugin for TeamCity versions 2017.1 and later for organizations that cannot upgrade immediately. TeamCity Cloud instances were already updated, while JetBrains said it has no evidence of active exploitation; CISA’s SSVC assessment likewise indicates no known exploitation but notes the bug is automatable and could have total technical impact. Successful attacks could expose TeamCity data, configurations, and stored credentials, or allow modification of server state depending on the privileges of the TeamCity process.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Jul 10, 2026 – Aug 5, 2026

Aug 5, 20263mo ago
CISA adds CVE-2026-63077 to KEV catalog
CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of the TeamCity flaw. This represented an escalation from earlier assessments that noted no known exploitation.
Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
Reported Jul 28, 20263mo ago
JetBrains releases fixed TeamCity versions and patch plugin
JetBrains fixed CVE-2026-63077 in TeamCity versions 2025.11.7 and 2026.1.3. It also released a security patch plugin for TeamCity 2017.1 and later for customers unable to upgrade immediately, while TeamCity Cloud instances were already updated.
Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
Reported Jul 27, 20263mo ago
CISA adds SSVC assessment for CVE-2026-63077
CISA added an SSVC assessment for CVE-2026-63077 indicating no known exploitation, that exploitation would be automatable, and that the technical impact would be total. This added government risk-triage context to the vulnerability record.
CVE-2026-63077 - JetBrains TeamCity Agent Polling Protocol Remote Code Execution
Reported Jul 27, 20263mo ago
JetBrains discloses TeamCity RCE vulnerability CVE-2026-63077
JetBrains disclosed a critical unauthenticated remote code execution flaw in TeamCity On-Premises, tracked as CVE-2026-63077, involving the agent polling protocol. The issue affects TeamCity versions before 2025.11.7 and 2026.1.3, and JetBrains said it had no evidence of active exploitation.
CVE-2026-63077 - JetBrains TeamCity Agent Polling Protocol Remote Code Execution
Jul 10, 20264mo ago
Antoni Tremblay privately reports CVE-2026-63077 to JetBrains
JetBrains said the TeamCity RCE vulnerability CVE-2026-63077 was privately reported by Antoni Tremblay. This establishes the initial vendor notification before public disclosure and patch release.
Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077) - Update to 2025.11.7 or 2026.1.3 Now - The JetBrains Blog

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Unauthenticated RCE in JetBrains TeamCity Agent Polling Protocol (CVE-2026-63077)

Affected products

2 linked

TeamcityTeamcity On-Premises

Organizations

1 linked

Jetbrains

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

23 references tracked. Mallory keeps watching after this page renders.

Triskele Labs BlogNews · Aug 25, 2026

Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)Open source ↗

Krcert KisaNews · Aug 10, 2026

JetBrains 제품 보안 업데이트 권고 > 보안공지 > 알림마당 : KISA 보호나라&KrCERT/CCOpen source ↗

Cyber Security NewsNews · Jul 31, 2026

Critical JetBrains Vulnerability Allow Attackers to Execute Malicious Code Remotely - Update NowOpen source ↗

InfoworldNews · Jul 31, 2026

JetBrains says a crafted HTTP request could break TeamCity | InfoWorldOpen source ↗

15 additional sources from 28-07-2026 to 31-07-2026

Jetbrains TeamcityNews · Jul 27, 2026

Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077) - Update to 2025.11.7 or 2026.1.3 Now - The JetBrains BlogOpen source ↗

CveAdvisories · Jul 27, 2026

CVE Record: CVE-2026-63077Open source ↗

Cvefeed High SeverityAdvisories · Jul 27, 2026

CVE-2026-63077 - JetBrains TeamCity Agent Polling Protocol Remote Code ExecutionOpen source ↗

Jetbrains TeamcityNews · Mar 4, 2024

Additional Critical Security Issues Affecting TeamCity On-Premises (CVE-2024-27198 and CVE-2024-27199) – Update to 2023.11.4 NowOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Critical JetBrains TeamCity RCE Enables Unauthenticated OS Command Execution

How this story unfolded

CISA adds CVE-2026-63077 to KEV catalog

JetBrains releases fixed TeamCity versions and patch plugin

CISA adds SSVC assessment for CVE-2026-63077

JetBrains discloses TeamCity RCE vulnerability CVE-2026-63077

Antoni Tremblay privately reports CVE-2026-63077 to JetBrains

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical TeamCity Deserialization Flaw Exploited to Execute Unauthenticated Commands

CISA Flags Actively Exploited JetBrains TeamCity RCE

JetBrains Patches TeamCity Flaw Exposing API Data and Enabling Privilege Escalation

Critical JetBrains TeamCity RCE Enables Unauthenticated OS Command Execution

How this story unfolded

CISA adds CVE-2026-63077 to KEV catalog

JetBrains releases fixed TeamCity versions and patch plugin

CISA adds SSVC assessment for CVE-2026-63077

JetBrains discloses TeamCity RCE vulnerability CVE-2026-63077

Antoni Tremblay privately reports CVE-2026-63077 to JetBrains

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical TeamCity Deserialization Flaw Exploited to Execute Unauthenticated Commands

CISA Flags Actively Exploited JetBrains TeamCity RCE

JetBrains Patches TeamCity Flaw Exposing API Data and Enabling Privilege Escalation