CVE-2026-63077TeamCity agent-polling protocol authentication bypass to RCE
What broke
TeamCity On-Premises accepted an unauthenticated request on the agent polling protocol, the channel build agents use to check in. Once past that check, the attacker runs OS commands as the server process. Every on-prem version was in scope. Cloud was not. JetBrains published on 27 July 2026, fixed in 2025.11.7 and 2026.1.3, with a back-ported plugin to 2017.1. We covered the disclosure in identity news. CISA added it to the Known Exploited Vulnerabilities catalog on August 5, 2026.
Why it matters
This is the third TeamCity authentication bypass in the catalog, after CVE-2023-42793 and CVE-2024-27198, both CISA KEV. CI credentials are production identity. An unauthenticated RCE there is a supply-chain foothold.
What to do
- Patch to 2025.11.7 / 2026.1.3, or confirm the security-patch plugin applied. Do not wait for "no confirmed exploitation."
- Keep TeamCity off the internet. Agent traffic can stay internal.
- If the server was public on 27 July 2026, rotate every credential the pipeline could reach.
After you patch
Patching closes the entry point. It does not remove access an attacker established through it.
- Revoke sessions and API tokens on the affected system rather than only resetting passwords.
- Audit accounts, tokens, and administrative changes made during the exposure window.
- Rotate credentials the system stored or could reach, including directory service accounts and integration keys. See secrets rotation.
- Treat the system as a pivot: whatever it could authenticate to is in scope until you have checked it.
Sources
Related identity CVEs
Related on Start with Identity
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.
- CVEConnectWise ScreenConnect auth bypass via an alternate path
ScreenConnect 23.9.7 and earlier skipped authentication on an alternate setup path (CWE-288). Attackers created admin users within hours. CISA KEV. CVSS 10.0. P
- BlogJetBrains was breached through an unpatched copy of its own TeamCity
Attackers exploited CVE-2026-63077 against a JetBrains-run TeamCity server to breach the Cadence cloud service, taking AWS IAM credentials, source code, and sec
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr