Critical Code Execution Vulnerability Patched in TeamCity

A critical code execution vulnerability, identified as CVE-2026-63077, has been patched in TeamCity, a popular continuous integration and continuous deployment tool. This security defect can be exploited without authentication, leveraging the agent polling protocol to gain unauthorized access. The vulnerability poses a significant risk, as it can be exploited by attackers to execute malicious code, potentially leading to a full system compromise. The fact that no authentication is required to exploit this vulnerability increases its severity, making it a high-priority patch for organizations using TeamCity¹. The disclosure of CVE-2026-63077 expands the active attack surface, highlighting the need for organizations to prioritize patching based on their exposure and evidence of exploitation. This vulnerability matters to practitioners because it underscores the importance of prompt patch management to prevent potential code execution attacks.