External risk intelligence

JetBrains TeamCity Agent Polling Protocol Unauthenticated Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-63077

JetBrains TeamCity is a server-side build management and CI/CD platform. These servers are commonly deployed as web-accessible services to facilitate remote access for distributed development teams, external integrations, and build agent communication, making them frequently reachable via the public internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in JetBrains TeamCity, a widely used continuous integration and continuous delivery platform. This issue could allow unauthorized individuals to execute arbitrary code remotely, potentially impacting the integrity and availability of systems involved in software development and deployment processes. The main concern is confirming relevance and exposure given the nature of the vulnerability.

Unauthenticated remote code execution risk.
Affects critical software development platforms.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests over the network to a TeamCity server. Since no authentication is required, an unauthenticated attacker can reach the agent polling protocol. Successful exploitation allows an attacker to execute arbitrary code on the server, leading to a complete compromise of the system.

No authentication needed.
Triggered via agent polling protocol.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated remote code execution could allow an attacker to compromise the TeamCity server and its build agents. This could affect the integrity and availability of the CI/CD system, and potentially sensitive data processed by build jobs when supported by the advisory.

Server and build agent systems at risk.
Via the agent polling protocol.
Compromise of CI/CD operations.

Operational Fix

Recommended remediation, mitigation, and detection steps

JetBrains TeamCity instances are likely managed by platform or infrastructure teams, with potential oversight from security and vendor management teams, depending on the deployment model. The first actionable step is to identify all TeamCity deployments, determine their exposure and criticality, and then locate the accountable owner to begin risk-based remediation planning.

Platform or infrastructure teams own the issue.
Verify TeamCity deployment reachability and criticality.
Plan and coordinate remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JetBrains TeamCity?

TeamCity is a server-side build management and continuous integration and delivery (CI/CD) platform. It automates software building, testing, and deployment. Development teams use it to manage code changes, run automated build pipelines, and coordinate communication between a central server and distributed build agents that perform the heavy lifting of compilation and testing.

What does CVE-2026-63077 mean?

This vulnerability is classified as CWE-502, which involves insecure deserialization. In plain terms, the server fails to safely process data it receives from an untrusted source. By sending a malicious, specially crafted message, an attacker can trick the system into treating that input as executable commands, leading to remote code execution where the attacker gains control over the server without needing a login.

How is this vulnerability triggered?

The issue resides in the agent polling protocol, which is the mechanism build agents use to check the server for new tasks. An attacker triggers this by sending unauthorized requests directly to this protocol. Because the protocol accepts these requests without checking for authentication, no prior access or user credentials are required to initiate the malicious payload that leads to code execution.

Is my TeamCity server at risk?

According to Halo Surface Signal, TeamCity servers are frequently deployed as web-accessible services to support remote teams and external integrations, often making them reachable via the public internet. If your instance is exposed to the internet, it is at higher risk because attackers can reach the vulnerable polling protocol directly. Internal-only instances are generally safer but still warrant investigation.

What should I do if I run TeamCity?

First, conduct an inventory to locate all TeamCity deployments across your organization. Once identified, verify which instances are reachable over the network and determine their criticality to your development operations. Coordinate with the teams managing these servers to prioritize remediation planning, starting with an assessment of your current version to see if it falls within the affected range.

References

www.jetbrains.com/privacy-security/issues-fixed/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.