CVE-2026-63077: TeamCity On-Premises unauthenticated RCE via the agent polling protocol

Exploited in the wild Critical 9.8 EPSS 93.6%

A deserialization flaw reachable through the TeamCity agent polling protocol lets an unauthenticated attacker with HTTP(S) access to a TeamCity On-Premises server bypass authentication and run operating system commands with the privileges of the TeamCity server process. JetBrains says all On-Premises versions are affected; it fixed the bug in 2025.11.7 and 2026.1.3 on July 27, 2026 and released a security patch plugin for 2017.1 and later, while TeamCity Cloud needs no action. JetBrains later received reports of active exploitation, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-05, marking it as known to be used in ransomware campaigns.

CVE-2026-63077CVE identifier
9.8CVSS 3.1 base score (critical)
2026-08-05added to CISA's exploited list (US federal deadline 2026-08-08)
93.6%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
2026-07-27published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run the affected software and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
After a manual upgrade, start the server and confirm the upgrade on the TeamCity Maintenance Mode page. If you use the security patch plugin instead, TeamCity 2018.2 and later can enable it without a restart; 2017.1 to 2018.1 need a server restart.
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
Because this flaw is being exploited, also check the server for signs of compromise.

Affected and fixed versions

Affected:

TeamCity On-Premises before 2025.11.7 (2025.11.x and all older versions)
TeamCity On-Premises 2026.1.x before 2026.1.3

Fixed in:

TeamCity 2025.11.7
TeamCity 2026.1.3

Am I affected?

curl -s -H 'Authorization: Bearer <token>' -H 'Accept: application/json' https://<teamcity-host>/app/rest/server
docker inspect --format '{{.Config.Image}}' teamcity-server-instance

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Docker images

# back up first; TeamCity Docker containers can only be updated manually
docker pull jetbrains/teamcity-server:2026.1.3   # or 2025.11.7
docker stop teamcity-server-instance && docker rm teamcity-server-instance
docker run -d --name teamcity-server-instance -v <path-to-data-directory>:/data/teamcity_server/datadir -v <path-to-logs-directory>:/opt/teamcity/logs -p <port-on-host>:8111 jetbrains/teamcity-server:2026.1.3

Built from source

# .tar.gz install in /opt/TeamCity; back up first (data directory, database, customized conf/server.xml)
# alternatively use Administration | Updates (automatic update) in the web UI
cd /opt
wget https://download.jetbrains.com/teamcity/TeamCity-2026.1.3.tar.gz   # or TeamCity-2025.11.7.tar.gz
sudo -u teamcity /opt/TeamCity/bin/teamcity-server.sh stop
sudo mv /opt/TeamCity /opt/TeamCity.old
sudo tar xfz TeamCity-2026.1.3.tar.gz
sudo chown -R teamcity:teamcity /opt/TeamCity
# re-apply any customized conf/server.xml settings, then:
sudo -u teamcity /opt/TeamCity/bin/teamcity-server.sh start

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

If you cannot patch yet

JetBrains security patch plugin for TeamCity 2017.1+ if you cannot upgrade: download https://download.jetbrains.com/teamcity/plugins/internal/fix_CVE_2026_63077.zip and install it (Administration | Plugins); TeamCity 2024.03+ downloads it automatically and offers it under Administration | Updates > Available security updates. It fixes only CVE-2026-63077.
JetBrains: if the server is reachable from the internet and you cannot patch immediately, temporarily restrict external access until you do.

Look for signs of exploitation

JetBrains: search TeamCity server logs for com.thoughtworks.xstream.converters.ConversionException, which may indicate an attempted or successful exploit; on patched servers com.thoughtworks.xstream.security.ForbiddenClassException indicates an attempt that was blocked.
JetBrains: review the list of unauthorized build agents for unexpected entries, especially names starting with 'scan'; use log timestamps rather than the agent's date to time the attempt.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/; https://www.jetbrains.com/privacy-security/issues-fixed/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63077

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.