First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-63077

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 24, 2026

Description

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
JetBrains	TeamCity	< 2026.1.3, 2025.11.7

References

Timeline

Published: Jul 27, 2026
Last modified: Oct 24, 2026
Added to CISA KEV: Aug 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-630799.8RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its de CVE-2026-63087.5Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI CVE-2026-630806.5Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers t CVE-2026-630815.4Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenti CVE-2026-630825.4Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated CVE-2026-630858.8Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to CVE-2026-630868.6text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compatible multimodal chat CVE-2026-630879.8Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthTok CVE-2026-630888.6stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers CVE-2026-630899.3WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that CVE-2026-63098.3Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potenti CVE-2026-630908.8ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low

CVE-2026-63077: Critical severity, CVSS 9.8 | Vulnix