JetBrains disclosed and patched CVE-2026-63077 on July 28, 2026 — a CVSS 9.8 Critical unauthenticated remote code execution vulnerability affecting all on-premises TeamCity installations running versions prior to 2025.11.7 and 2026.1.3. Researcher Antoni Tremblay reported the vulnerability on July 10, and JetBrains issued patched releases and an emergency plugin before public disclosure.
How CVE-2026-63077 Exploits the TeamCity Agent Polling Protocol
TeamCity’s agent polling protocol manages communication between the build server and its distributed build agents. CVE-2026-63077 exploits a flaw in this protocol’s authentication logic: an attacker with HTTP or HTTPS access to the TeamCity server can send crafted requests that bypass authentication checks entirely, gaining the ability to execute arbitrary OS commands at the privilege level of the TeamCity process — without any valid credentials, user account, or prior foothold.
The authentication bypass requires only network reach to the server. No admin access, active session, or authenticated user interaction is needed. Any TeamCity on-premises server accessible from the internet is exposed to exploitation by any attacker who can send an HTTP request to it, placing this in the class of vulnerabilities that can be automated and scanned for at internet scale.
What Attackers Can Access After Compromising a TeamCity Server
TeamCity sits at the center of enterprise software build pipelines. Successful exploitation of CVE-2026-63077 gives an attacker access to build artifacts, build configuration files, secrets and credentials embedded in pipeline scripts, and deployment keys stored on the server. In enterprise environments, TeamCity commonly holds API keys, container registry credentials, and cloud provider access tokens used during automated deployments.
A TeamCity server compromise is particularly dangerous because it can serve as a platform for supply-chain attacks: an attacker who can modify build configurations or inject steps into pipelines can introduce malicious code into software artifacts before they are signed and shipped. This kind of access is what makes CI/CD systems high-value targets for state-sponsored and criminal actors seeking persistent influence over software distribution.
Antoni Tremblay’s Discovery and JetBrains’ Patch in Versions 2025.11.7 and 2026.1.3
Researcher Antoni Tremblay discovered and reported CVE-2026-63077 to JetBrains on July 10, 2026. JetBrains produced two patched releases: version 2025.11.7 for organizations running the 2025.11 branch, and version 2026.1.3 for those on the 2026.1 branch. For organizations that cannot immediately upgrade, JetBrains released a separate security patch plugin compatible with TeamCity versions 2017.1 and later. JetBrains confirmed that hosted and cloud-managed TeamCity environments were patched separately and are not affected by CVE-2026-63077.
JetBrains also recommended that organizations place internet-facing TeamCity servers behind VPN connections or restrict inbound access to trusted network ranges while patches are staged for deployment.
Prioritizing Patch Deployment for Internet-Exposed TeamCity Installations
As of July 28, 2026, JetBrains reported no confirmed evidence of active in-the-wild exploitation. However, the CVSS 9.8 rating places CVE-2026-63077 in the maximum-priority patch tier, and the unauthenticated nature of the attack means that any internet-exposed instance should be treated as at risk regardless of perceived obscurity.
Organizations should upgrade to version 2025.11.7 or 2026.1.3 as the primary remediation step. Those unable to update immediately should deploy the JetBrains security patch plugin and verify that TeamCity is not reachable without VPN or IP-allowlist restrictions. Patch deployment should not wait for scheduled maintenance windows given both the severity of the vulnerability and the history of rapid weaponization against CI/CD platforms when critical flaws enter public knowledge.
The pipeline access CVE-2026-63077 could provide — build artifacts, deployment secrets, and supply-chain injection capability — represents exactly the class of access that has motivated nation-state compromises of development infrastructure in recent years. Even absent confirmed exploitation, the potential consequences of a successful attack through this flaw demand immediate remediation priority. JetBrains’ combination of a direct patch and a plugin-based fix for older installations gives organizations two remediation paths; choosing the appropriate one and deploying it promptly is the most effective available defense.
