TeamCity RCE exploited in the wild (CVE-2026-63077) [PoC]

Actively exploited in the wild - CVE-2026-63077 is a critical unauthenticated remote code execution vulnerability in JetBrains TeamCity before 2026.1.3 and 2025.11.7 that lets remote attackers take full control of the CI/CD server via the agent polling protocol. Patched versions are available - update immediately.

Overview

CVE-2026-63077 affects JetBrains TeamCity, a widely used continuous integration and continuous deployment (CI/CD) server. The vulnerability resides in the agent polling protocol, which is the communication channel TeamCity uses to let build agents check for pending jobs. An unauthenticated attacker can send crafted requests to this protocol and execute arbitrary code on the server without any credentials.

The vulnerability carries a CVSS score of 9.8 (Critical), reflecting that it requires no privileges, no user interaction, and can be exploited remotely over the network. CISA has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.

Impact

Successful exploitation gives an attacker complete remote code execution on the TeamCity server. Because TeamCity often holds source code, build artifacts, deployment credentials, and access to production environments, a compromise can lead to:

• Supply chain attacks through tampered build outputs
• Theft of API tokens, private keys, and cloud credentials
• Lateral movement into connected development and production infrastructure
• Persistent backdoor access to the CI/CD pipeline

Despite a low EPSS score of 0.6%, the confirmed active exploitation makes this a priority for any organization running an affected version.

Remediation

JetBrains has released fixed versions: 2026.1.3 and 2025.11.7. Upgrade to either version immediately. For organizations that cannot patch right away:

• Restrict network access to the agent polling port (default 9090) so only trusted build agents can reach it
• Place TeamCity behind a firewall or VPN and ensure it is not directly exposed to the internet
• Review agent connections and logs for anomalous polling requests
• Monitor for unauthorized file creation or process execution on the TeamCity host

Security Insight

This vulnerability follows a troubling pattern for TeamCity, which has seen multiple critical RCE flaws in recent years, including CVE-2024-23917 and CVE-2023-42793. The recurring theme is that CI/CD systems are prime targets because they hold the keys to the software supply chain. Attackers are not waiting for patches - they are racing to exploit these systems before defenders update. The active exploitation of CVE-2026-63077 underscores that build infrastructure must be treated as crown-jewel assets, not internal tools, and patched with the same urgency as internet-facing edge devices.

For the latest on this and similar incidents, see our security news and breach reports.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs