A critical vulnerability in JetBrains TeamCity allows unauthenticated remote attackers to execute arbitrary code via the agent polling protocol.

This is a deserialization vulnerability (CWE-502) in the agent polling protocol. The vulnerability allows unauthenticated remote attackers to achieve remote code execution, as indicated by the CVSS vector AV:N/PR:N.

With a CVSS score of 9.8, this vulnerability presents a severe risk to CI/CD pipelines. Successful exploitation could allow an attacker to compromise build artifacts, steal source code, or gain persistent access to the internal network.

Immediate Action: Upgrade JetBrains TeamCity to version 2026.1.3, 2025.11.7, or the latest available version immediately.

Proactive Monitoring: Review audit logs for unexpected connections to the agent polling port and monitor for unauthorized process creation on the TeamCity server.

Compensating Controls: Restrict network access to the TeamCity agent polling interface using firewall rules or network segmentation to ensure only authorized build agents can communicate with the server.

Public Exploit Available: No (exploit_available: false)

Organizations using JetBrains TeamCity should treat this as a high-priority security event. Upgrading to the patched version is essential to secure the development environment and protect against unauthorized access to code repositories and build infrastructure.