CVE-2026-63077KEVEXPLOITEDPATCHED

jetbrains · teamcity

CVE-2026-63077: In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin

Description

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Affected Products

Vendor	Product	Versions
jetbrains	teamcity	0

Also Affects

Downstream vendors/products affected by this vulnerability

Vendor	Product	Source	Confidence
jetbrains	teamcity	cert_advisory	90%

References

Related News (12 articles)

Tier B

CERT-FR14d ago

Bulletin d'actualité CERTFR-2026-ACT-034 (10 août 2026)

→ No new info (linked only)

Tier C

Rapid7 Blog16d ago

Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)

→ No new info (linked only)

Tier D

The Hacker News17d ago

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild

→ No new info (linked only)

Tier D

CSO Online23d ago

JetBrains says a crafted HTTP request could break TeamCity

→ No new info (linked only)

Tier D

SecurityWeek23d ago

Critical Code Execution Vulnerability Patched in TeamCity

→ No new info (linked only)

Tier D

BleepingComputer24d ago

JetBrains warns of critical TeamCity remote code execution flaw

→ No new info (linked only)

Tier C

Rapid7 Blog25d ago

CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity

→ No new info (linked only)

Tier D

Heise Security25d ago

Kritische Schwachstelle in JetBrains TeamCity entdeckt

→ No new info (linked only)

Tier D

Help Net Security26d ago

JetBrains fixes critical unauthenticated RCE in TeamCity On-Premises (CVE-2026-63077)

→ No new info (linked only)

Tier B

BSI Advisories26d ago

[NEU] [hoch] JetBrains TeamCity: Schwachstelle ermöglicht Codeausführung

→ No new info (linked only)

Tier D

The Hacker News26d ago

Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In

→ No new info (linked only)

Tier C

VulDB27d ago

CVE-2026-63077 | JetBrains TeamCity prior 2026.1.3/2025.11.7 Agent Polling Protocol code injection

→ No new info (linked only)

CVSS 3.19.8 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEV✅ Yes

Actively exploited✅ Yes

Patch available

2026.1.32025.11.7

CWECWE-502

PublishedJul 27, 2026

Last enriched27d ago

Trending Score23

Source articles12

Independent10

Info Completeness9/14

Missing: epss, kev, exploit, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-75060

CVE-2026-75060: In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools

Trending: 22

HIGHCVE-2026-75056

CVE-2026-75056: In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible

Trending: 22

CRITICALCVE-2026-75045

CVE-2026-75045: In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download data

Trending: 22

MEDIUMCVE-2026-75059

CVE-2026-75059: In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible

Trending: 20

MEDIUMCVE-2026-75054

CVE-2026-75054: In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects

Trending: 17

Pin to Dashboard

Verification

State: verified

Confidence: 0%

Vulnerability Timeline

CVE Published

Jul 27, 2026

Added to CISA KEV

Jul 27, 2026

Discovered by ZDM

Jul 27, 2026

Actively Exploited

Aug 6, 2026

Exploit Available

Aug 6, 2026

Patch Available

Aug 6, 2026