CVE-2026-63077KEVEXPLOITEDPATCHED

jetbrains · teamcity

CVE-2026-63077: In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin

Description

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Affected Products

Vendor	Product	Versions
jetbrains	teamcity	0

Also Affects

Downstream vendors/products affected by this vulnerability

Vendor	Product	Source	Confidence
jetbrains	teamcity	cert_advisory	90%

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Related News (11 articles)

Tier C

Rapid7 Blog1d ago

Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)

→ No new info (linked only)

Tier D

The Hacker News2d ago

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild

→ No new info (linked only)

Tier D

CSO Online8d ago

JetBrains says a crafted HTTP request could break TeamCity

→ No new info (linked only)

Tier D

SecurityWeek8d ago

Critical Code Execution Vulnerability Patched in TeamCity

→ No new info (linked only)

Tier D

BleepingComputer9d ago

JetBrains warns of critical TeamCity remote code execution flaw

→ No new info (linked only)

Tier C

Rapid7 Blog10d ago

CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity

→ No new info (linked only)

Tier D

Heise Security10d ago

Kritische Schwachstelle in JetBrains TeamCity entdeckt

→ No new info (linked only)

Tier D

Help Net Security11d ago

JetBrains fixes critical unauthenticated RCE in TeamCity On-Premises (CVE-2026-63077)

→ No new info (linked only)

Tier B

BSI Advisories11d ago

[NEU] [hoch] JetBrains TeamCity: Schwachstelle ermöglicht Codeausführung

→ No new info (linked only)

Tier D

The Hacker News11d ago

Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In

→ No new info (linked only)

Tier C

VulDB12d ago

CVE-2026-63077 | JetBrains TeamCity prior 2026.1.3/2025.11.7 Agent Polling Protocol code injection

→ No new info (linked only)

CVSS 3.19.8 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEV✅ Yes

Actively exploited✅ Yes

Patch available

2026.1.32025.11.7

CWECWE-502

PublishedJul 27, 2026

Last enriched12d ago

Trending Score135🔥

Source articles11

Independent9

Info Completeness9/14

Missing: epss, kev, exploit, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-64813

CVE-2026-64813: In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session

Trending: 10

CRITICALCVE-2026-64812

CVE-2026-64812: In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

Trending: 10

HIGHCVE-2026-64814

CVE-2026-64814: In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

Trending: 9

HIGHCVE-2026-64807

CVE-2026-64807: In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration

Trending: 8

HIGHCVE-2026-64811

CVE-2026-64811: In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via develop

Trending: 8

Pin to Dashboard

Verification

State: verified

Confidence: 0%

Vulnerability Timeline

CVE Published

Jul 27, 2026

Added to CISA KEV

Jul 27, 2026

Discovered by ZDM

Jul 27, 2026

Actively Exploited

Aug 6, 2026

Patch Available

Aug 6, 2026