JetBrains TeamCity versions before 2026.1.3 and 2025.11.7 contain an unauthenticated remote code execution flaw in the agent polling protocol. The vulnerability is a classic deserialization flaw (CWE-502), allowing an attacker to send crafted data that is executed by the TeamCity server. Consequently, an attacker can gain full control of the host where TeamCity is running, reading, modifying, or deleting any data, and installing malware or executing arbitrary commands. The flaw is assessed with a CVSS score of 9.8, indicating a critical risk.

JetBrains TeamCity software before the releases 2026.1.3 and 2025.11.7 is vulnerable. Anyone running these legacy versions is at risk if the device is exposed to an outsider.

The flaw is reachable through the agent polling endpoint, which accepts input from remote agents without authentication. An attacker does not need local access or credentials; merely placing a malicious payload in the polling request will execute arbitrary code on the TeamCity server. The EPSS score is 11% and the vulnerability is listed in CISA KEV, but the high CVSS score and lack of authentication make exploitation highly attractive for adversaries.