Critical· 9.8official fix available
CVE-2026-63077
A critical flaw in JetBrains TeamCity lets attackers run code on the server without authentication. The flaw is in the agent polling protocol and can be exploited by anyone on the network. It affects all TeamCity installations older than version 2026.1.3.
publishedJul 27, 2026
last modifiedJul 28, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
47th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 26, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
JetBrains TeamCity servers running versions older than 2026.1.3 (including 2025.11.7).
02
Real-world impact
An attacker could take full control of the TeamCity server, steal data, or use it to launch further attacks.
03
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable from any network location, requires no user interaction, and gives an attacker complete control over the system.
04
What to do about it
official fix available
recommended steps
- 011. Verify the current TeamCity version.
- 022. Download and install TeamCity 2026.1.3 or newer from the JetBrains website.
- 033. Restart the TeamCity service to apply the update.
NVD description
05
Timeline
- Jul 27, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →