CVE-2026-63077: Critical RCE Flaw in JetBrains TeamCity Agent Polling Protocol

Unauthenticated remote attackers can execute arbitrary code on vulnerable build servers due to a critical JetBrains TeamCity vulnerability tracked as CVE-2026-63077. Carrying a CVSS score of 9.8, the flaw exists within the application’s handling of untrusted data passed through the agent polling protocol. Because TeamCity serves as the central control plane for enterprise build pipelines, unauthenticated remote code execution (RCE) at this layer gives adversaries an immediate foothold inside core software development environments.

Technical Mechanism & Attack Path

The vulnerability stems from improper input validation when the TeamCity server handles incoming requests over its agent polling channel. In a standard deployment, build agents regularly poll the server for new jobs, status checks, and configuration updates. This communication relies on serialized data objects to transfer structured parameters between the central server and distributed build nodes.

An unauthenticated attacker capable of reaching the agent polling endpoint can craft a malicious payload and submit it directly to the polling listener. When TeamCity deserializes the untrusted data, it instantiates arbitrary classes on the application classpath without authenticating the incoming request first, resulting in immediate remote code execution.

Because TeamCity instances frequently run with high privileges—and interact directly with underlying host systems—successful exploitation typically yields complete host compromise. From this vantage point, an attacker can:

• Extract stored deployment secrets, API keys, code-signing certificates, and cloud provider access tokens embedded in build parameters.
• Tamper with build scripts and source code, injecting malicious backdoors into compiled software artifacts before distribution.
• Pivot laterally from the CI/CD environment into interconnected internal corporate networks or production cloud infrastructure.

High-Value Target Profile and Threat Context

Continuous integration and continuous delivery (CI/CD) systems like JetBrains TeamCity represent high-yield targets for sophisticated adversaries. Threat actors, including state-sponsored APT groups and ransomware operators, routinely prioritize vulnerabilities in CI/CD platforms because compromising a single build server can grant indirect access to downstream customers and sensitive production environments.

Environments where TeamCity instances expose their management interface or agent communication endpoints to the public internet carry the highest risk profile. However, internal installations remain highly exposed to lateral movement if an attacker establishes an initial access foothold elsewhere on the internal network.

Remediation and Hardening Guidelines

Organizations running JetBrains TeamCity must treat CVE-2026-63077 as an urgent remediation item. Apply the following steps to eliminate exposure:

• Apply Vendor Patches Immediately: Upgrade all TeamCity server instances to the latest software release specified in JetBrains’ advisory. Ensure that automatic agent updates complete across all connected build nodes so that patched communication libraries are deployed end-to-end.
• Isolate Agent Communication Channels: Restrict access to the agent polling protocol endpoints using firewalls or network access control lists (ACLs). Ensure agent polling listeners are accessible only to trusted, statically defined build agent IP addresses and never exposed to the public internet.
• Credential Invalidation and Audit: If an instance was exposed prior to applying the patch, assume the server state may be compromised. Rotate all VCS access tokens, cloud service credentials, SSH keys, and secret environment variables stored within TeamCity project settings.
• Enforce Mutual Authentication: Verify that agent-to-server communication enforces strict mutual TLS (mTLS) and token authentication to prevent rogue or unauthorized agents from connecting to the server controller.