The TeamCity RCE Under Active Exploitation Will Never Be Patched on Nine Version Lines — CVE-2026-63077

By Scott Bissett  ·  Published: August 12, 2026  ·  EOL Watch — news analysis  ·  CVE-2026-63077 · CVSS 9.8 (JetBrains) · CISA KEV  ·  Verified against CISA's KEV catalog, JetBrains's fixed-issues advisory, and our tracked lifecycle data — methodology

On August 5, 2026, CISA added CVE-2026-63077 — an unauthenticated remote code execution vulnerability in JetBrains TeamCity — to its Known Exploited Vulnerabilities catalog, and gave federal agencies until August 8 to fix it. Three days. KEV remediation windows are normally measured in weeks; a three-day deadline is CISA's way of saying the exploitation it can see is not theoretical, not targeted, and not waiting.

The vulnerability is the bad kind on every axis. It sits in TeamCity's agent polling protocol — the channel build agents use to check in with the server — and it is a deserialization of untrusted data flaw that requires no credentials and no user interaction: HTTP or HTTPS access to the server is the entire prerequisite. JetBrains, as the CVE Numbering Authority, rates it CVSS 9.8; NVD had not yet published its own score at our last review. JetBrains disclosed and fixed it on July 27, 2026 in its fixed security issues advisory, shipping the fix in exactly two builds: 2025.11.7 and 2026.1.3. Nine days later it was on the KEV.

That is the news. Here is the part this article exists for: under JetBrains's support policy, those two builds are the only places the fix will ever exist. Nine TeamCity version lines — every release from 2022.04 through 2025.07 — are past end of life, inside the affected range, and will never receive this patch. If your server runs any of them, CVE-2026-63077 is not a patching task on your backlog. It is a permanent property of the software until you upgrade.

Your build server is your most-trusted machine

Rank the machines in your estate by how much damage their compromise causes, and the CI server lands at or near the top — above most production systems. A production web server that gets popped leaks what it holds. A CI server that gets popped hands over the means of production: it holds credentials for version control, artifact repositories, container registries, cloud accounts, and deployment targets, and — the part that separates it from every other credential store — it decides what code ships. An attacker with code execution on the TeamCity server does not need to steal your product; they can modify what your pipelines build and sign, and your own release process will distribute it for them. That is the definition of a supply-chain compromise, executed from inside the machine every other control trusts.

This is not a hypothetical for TeamCity specifically. In March 2024, CVE-2024-27198 — an authentication bypass in TeamCity On-Premises, also rated 9.8 — was added to CISA's KEV catalog within days of disclosure, with CISA noting its use in ransomware campaigns. Exploitation was broad and fast: attackers created rogue administrator accounts on exposed servers at scale. The product category was mass-hunted then, and the KEV listing for CVE-2026-63077 says it is being hunted now. The 2024 wave is the precedent; this is the sequel with a worse opening — no authentication step to bypass, just a network path to the server.

Thirty seconds: which TeamCity are you running?

TeamCity prints its version in the footer of its web pages — including, on default configurations, the login page, which means the same check is available to anyone else with a route to your server. From any machine that can reach it:

curl -sk https://teamcity.example.com/login.html | grep -oE 'Version [0-9.]+'

Or in the UI: any page footer, or Administration → Updates. If the answer is 2025.11.7 or 2026.1.3 (or later), you are patched against this CVE. If it is anything else, the next table tells you which of two very different situations you are in.

Which versions get a fix — and which are permanently exposed

The affected statement in our Exploited & Unpatchable feed entry, verified against JetBrains's advisory: all releases prior to 2025.11.7, and 2026.1 through 2026.1.2. JetBrains provides security fixes only for the current and immediately previous release lines — so the fix lands in 2025.11 and 2026.1, and nowhere else, ever. Dates below are from our tracked TeamCity lifecycle data, current as of the verification pass on August 12, 2026.

Two rows deserve a second look. On the supported lines, note that being "supported" is not the same as being patched — a server on 2026.1.2 or 2025.11.6 is inside the affected range until it takes the point update. And at the top of the EOL block sits 2025.07, which reached end of life on May 11, 2026 — roughly three months before the KEV listing. A TeamCity server that was fully patched and fully supported in April 2026 is in the permanently-vulnerable set today. That is how short the distance is between "current" and "will never see another fix" on a product that supports only its two newest lines — the same mechanic we documented on Jenkins the week before last, where every LTS except the newest baseline lost access to a critical controller RCE fix overnight.

The upgrade-or-isolate decision

For servers on a supported line, there is no decision — take the point update to 2025.11.7 or 2026.1.3 today. It is a maintenance release on a line you are already running; the KEV clock says it outranks whatever else was scheduled this week.

For servers on an end-of-life line, the honest framing is the one from the table: there is no patch for you, and there never will be. The fix for CVE-2026-63077 is not an update you apply — it is an upgrade you undertake. That leaves three moves, in order of preference:

1. Upgrade to a supported line — the real fix. TeamCity upgrades from old lines are rarely hard because of TeamCity itself; the work lives in plugin compatibility, agent rollover, and — for the oldest lines — any database and configuration migration between your version and 2025.11/2026.1. Start scoping it today, because the KEV listing means the scanning has already started.

2. Isolate while the upgrade is scheduled. The exploit's only prerequisite is HTTP/HTTPS access to the server, so the mitigation with real teeth is subtraction: remove the server from the public internet if it is there (and check — Shodan-visible TeamCity servers were the fuel of the 2024 exploitation wave), and restrict inbound access to the narrowest set of networks that keeps builds running. Then act on the trust question: audit and rotate the credentials the server holds — VCS tokens, registry credentials, deploy keys — on the assumption that exposure between July 27 and your remediation date was not zero.

3. If neither happens now, write it down. A CI server carrying a KEV-listed, actively-exploited, never-to-be-patched unauthenticated RCE is a finding under any serious audit framework. A documented risk acceptance with the isolation controls above attached is defensible for the weeks an upgrade takes to land. Silence is not — and on this CVE, the federal government's own deadline for its agencies was three days.

The full verified entry — affected statement, KEV dates, fixed versions, and sources to CISA, NVD, and JetBrains — is in our Exploited & Unpatchable feed, with a free JSON feed at /exploited-and-unpatchable.json. Every entry is verified against the vendor's own advisory before it goes in; "unpatchable" means the vendor's documentation says so, not that we infer it. We track TeamCity and 480+ other products against vendor-verified dates — every TeamCity line with live status, or check any version in seconds.

Frequently Asked Questions

Related

• All TeamCity versions with live status · TeamCity 2025.07 — dates and risk score
• Exploited & Unpatchable — the verified feed of KEV-listed vulnerabilities that end-of-life versions will never get fixes for, including this entry
• Every Jenkins LTS except the newest is now permanently vulnerable — the same story on the other major CI server, one week earlier
• GitLab 19.0 stops receiving security patches on August 20 — the third CI/CD platform on the clock this month, with a 91-day support window
• Why End of Life Is Inevitable — the economics behind "fixes ship only in current lines," for every vendor