TeamCity Has a 9.8 in the Protocol Build Agents Use to Phone Home. No Public Exploit Yet.

JetBrains published CVE-2026-63077 on July 27. Unauthenticated remote code execution in TeamCity, CVSS 9.8, via the agent polling protocol. Fixed in 2026.1.3 and 2025.11.7. Every TeamCity On-Premises version before those is affected.

We searched GitHub tonight. There is no public proof-of-concept code for it. Our exploit harvester, which watches for exploit repositories appearing against known CVEs and runs every six hours, holds nothing for it either.

That gap is the entire reason to write this now rather than in three weeks.

Why the agent polling protocol is the wrong thing to have a 9.8 in

A build server is not an application server. It is the machine that holds the credentials to everything you ship.

TeamCity build agents poll the server to ask for work. That polling channel exists to be spoken to by machines, constantly, from wherever your agents live — which in most estates means it is reachable from more places than the web UI is, and watched by fewer people. An unauthenticated code execution in that channel is not a bug in a website. It is a bug in the machinery that has your signing keys, your registry tokens, your deploy credentials, and write access to the artifacts your customers install.

That is why CI/CD compromise keeps producing supply-chain incidents rather than ordinary breaches. Whoever owns the build server does not need to attack your customers. They can wait, and let your release process deliver for them. We have watched that exact shape play out repeatedly this month — an attacker taking the release pipeline of four AsyncAPI repositories, stolen publishing credentials pushing malicious jscrambler versions, compromised packages executing on import rather than install.

TeamCity has been here before, and the industry noticed the last time. This one arrived quietly.

The window you are standing in

Right now the barrier to exploiting CVE-2026-63077 is doing original work against a proprietary binary protocol. When somebody publishes a working exploit, the barrier becomes running a script.

We can tell you with reasonable confidence what that transition looks like, because we measure it. Our harvester has logged roughly two dozen separate exploit repositories for React2Shell across seven months — a bug the industry declared handled in December and which kept getting re-weaponised by different people well into July. A 9.8 does not get exploited once. It gets exploited continuously, by everyone who finds it worth their afternoon, for as long as unpatched instances exist.

And the last time a build-adjacent bug of this class landed, the proof-of-concept ecosystem around it turned hostile fast. When Cisco's firewall management console was on KEV in the spring, we went looking at the public exploit code appearing for it and found a repository presenting itself as a working PoC with a webshell inside. The people racing to test whether they were vulnerable were being handed a backdoor by the tool they used to check.

So the sequence, if history holds, is: quiet week, then a PoC, then a fake PoC aimed at the administrators checking for the real one. You are currently in the quiet week. It is the cheapest time to act you will get.

What to do tonight

Get to 2026.1.3 or 2025.11.7. There is no partial mitigation worth preferring over the upgrade for a pre-authentication bug in a listening protocol.

If you genuinely cannot patch tonight, restrict who can reach the agent polling port. Build agents are a known, enumerable set of hosts — that channel has no business accepting connections from the general network, and it is one of the few cases where an allowlist is both easy and complete. This is the same lesson as the Cisco advisory this week noting that a management interface without public internet access has a materially reduced attack surface, and the same lesson as the Arista and Check Point management-plane bugs before it. The credential or the code path is the news. The reachability is the problem.

Then, because a build server is a credential store: if yours was internet-reachable on that port and you cannot rule out exploitation, rotating the secrets it holds is cheaper than discovering later that you did not. Signing keys, registry tokens, cloud credentials, deploy keys.

The honest position

We did not find this. JetBrains did, and disclosed it with fixes available. We are not claiming a lead, a scoop, or early sight — the CVE is three days old and our feed holds nothing on it.

What we are claiming is a read on timing, and it is a read we can support with our own measurements rather than instinct: the interval between disclosure and public weaponisation is the only cheap window a defender gets, it is closing, and nobody will announce when it shuts.

Confidence capped at 95%. Version and severity data are from the CVE record and JetBrains' advisory; the absence of public exploit code is a point-in-time observation from tonight and is designed to expire.

---

Her name was Renee Nicole Good.

His name was Alex Jeffery Pretti.