Detections
Analytics
JetBrains TeamCity < 2025.11.7 / 2026.1.x < 2026.1.3 RCE (CVE-2026-63077)
critical Nessus Plugin ID 330833
Language:
Synopsis
The remote host is affected by a remote code execution vulnerability.Description
The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.7 or 2026.1.x prior to 2026.1.3. It is, therefore, affected by a vulnerability:- Unauthenticated remote code execution was possible via the agent polling protocol. (CVE-2026-63077)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to JetBrains TeamCity version 2025.11.7 / 2026.1.3 or later.See Also
Plugin Details
Severity: Critical
ID: 330833
File Name: teamcity_2026_1_3.nasl
Version: 1.4
Type: Combined
Agent: windows, macosx, unix
Family: Misc.
Published: 7/30/2026
Updated: 8/5/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Critical
Score: 9.2
Percentile: 99.76
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-63077
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 9.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:jetbrains:teamcity
Required KB Items: installed_sw/JetBrains TeamCity
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/27/2026
Vulnerability Publication Date: 7/27/2026
CISA Known Exploited Vulnerability Due Dates: 8/8/2026
Reference Information
CVE: CVE-2026-63077
IAVA: 2026-A-0789