CVE-2026-63077

This vulnerability lets a malicious person connect to your TeamCity server and make it run attacker-controlled code, without needing a username or password. It’s like someone bypassing the front door and getting full control of the building systems the moment they can reach your office.

This matters if you run JetBrains TeamCity and your TeamCity is reachable over the network, because the agent polling protocol does not require authentication. CISA has listed this issue in KEV, which means you should treat it as a real, time-sensitive risk for systems that can be contacted from the outside. Only a risk if the affected TeamCity instance is reachable over the network (for example, internet-facing, or exposed through your network edge).

This is RED because CISA added CVE-2026-63077 to the KEV catalog (added 2026-08-05), which signals it’s a serious, actionable risk that organizations should address quickly. Since the flaw is unauthenticated remote code execution over the network, an attacker who can reach the service can potentially take over the system; your remediation should be completed by the CISA due date.