CVE-2026-63077: JetBrains TeamCity Agent-Polling Unauthenticated RCE (KEV)

CVE-2026-63077 is an unauthenticated remote-code-execution vulnerability in JetBrains TeamCity: an attacker who can reach a TeamCity server over HTTP(S) can abuse the agent polling protocol to deserialize untrusted data, bypass authentication, and run arbitrary OS commands as the TeamCity server process — with no login required — and CISA added it to KEV with just a 3-day remediation window reflecting known use in ransomware-adjacent intrusions.

CVE-2026-63077 affects JetBrains TeamCity, a widely deployed CI/CD build-automation server, in versions before 2025.11.7 and in the 2026.1 branch before 2026.1.3. NVD's description states: "unauthenticated remote code execution was possible via the agent polling protocol" (NVD).

JetBrains' own CNA-submitted score, which NVD stores as a Secondary (not NVD Primary) metric, is CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction. CWE-502 (Deserialization of Untrusted Data) is the assigned weakness (NVD).

JetBrains' own blog post explains the mechanics in plain terms: "Exploitation of this vulnerability does not require authentication. An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process," warning this can expose "TeamCity data, configurations, and stored credentials" and compromise "downstream CI/CD pipelines." Notably, JetBrains states: "At the time of publishing this advisory, we are not aware of any active exploitation of this vulnerability" — exploitation was observed only afterward. The fix ships as an automatic security-patch plugin for TeamCity 2024.03+, or as an upgrade to 2025.11.7 / 2026.1.3 (JetBrains TeamCity Blog).

CISA added CVE-2026-63077 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-05, with a required-action due date of just 2026-08-08 (3 days), and recorded "Known" ransomware campaign use — meaning exploitation, including ransomware-adjacent activity, was confirmed in the roughly two weeks between JetBrains' disclosure and the KEV listing (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.93558 (99.840th percentile) — among the highest EPSS scores of any advisory on this site, consistent with an unauthenticated, no-user-interaction RCE in widely internet-exposed CI/CD infrastructure with confirmed in-the-wild use (FIRST EPSS).

Because build servers hold source code, secrets and deployment credentials, any internet-reachable TeamCity server on an affected version should be upgraded or patched immediately, and JetBrains' broader recommendation — never exposing the TeamCity login screen or REST API directly to the internet, using a VPN or equivalent access layer instead — should be treated as a standing requirement, not just a mitigation for this one CVE.

• Deserialization of untrusted data (CWE-502) reachable via the agent polling protocol allows unauthenticated remote code execution. — NVD
• CVSS v3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is JetBrains' own CNA-submitted score, stored by NVD as a Secondary (not NVD-confirmed) metric. — NVD
• Unauthenticated attacker can bypass authentication via the agent polling protocol and run OS commands as the TeamCity server process; JetBrains was not aware of active exploitation at publication time; fixed in 2025.11.7 / 2026.1.3 or via automatic security-patch plugin. — JetBrains TeamCity Blog
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-05, required action due 2026-08-08, known ransomware campaign use recorded as "Known". — CISA KEV
• EPSS score is 0.93558 (99.840th percentile) as of 2026-10-27. — FIRST EPSS