JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
  • Highest CVSS: 9.8 (Critical).
  • Listed in CISA KEV (2026-08-05) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-63077.

What it is

CVE-2026-63077 is a deserialisation of untrusted data vulnerability in JetBrains TeamCity. It sits in the agent polling protocol, which handles communication between TeamCity build agents and the server.

The flaw allows unauthenticated remote code execution over the network. An attacker does not need credentials or any prior access to the TeamCity server or agents to reach the vulnerable code path — it’s exploitable directly against the polling mechanism. Given the CVSS vector (AV:N/AC:L/PR:N/UI:N), no user interaction is required and complexity is low.

The impact is complete: confidentiality, integrity and availability are all rated high. Successful exploitation gives an attacker code execution on the affected system, with no indication that the flaw is limited to a subset of functionality or data.

This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-08-05, so it is known to be exploited.

What to do

  • Treat this as urgent. A CVSS score of 9.8, unauthenticated RCE, and CISA KEV listing together mean this should be at the top of the patching queue.
  • Check the JetBrains advisory directly for fixed releases, as none are listed here yet — confirm the exact version your instance should be upgraded to before acting.
  • If a fix is not yet available for your version, restrict network access to the TeamCity server and agent polling endpoints to trusted hosts only, as an interim mitigation.
  • Review TeamCity server and agent logs for anomalous activity around the agent polling protocol, particularly since KEV listing.
  • If TeamCity is internet-facing, consider taking it offline or placing it behind a VPN/allowlist until patched, given the low bar for exploitation.
  • Once patched, rotate any credentials or secrets stored in or accessible via TeamCity, as a precaution given the RCE impact.

For leadership 🧭

Executive summary. TeamCity servers are exposed to remote code execution by anyone who can reach the agent polling endpoint, and this is already being exploited according to CISA’s KEV listing. Given the build server’s role in CI/CD, this needs emergency patching or isolation today, not at the next scheduled window.

Why it matters:

  • The flaw sits in the agent polling protocol that TeamCity build agents use to talk to the server, so any network path to that channel is a potential entry point.
  • No credentials or user interaction are required, and the CVSS 9.8 score reflects complete loss of confidentiality, integrity and availability on the affected system.
  • TeamCity servers typically hold build secrets, source access and deployment credentials, so code execution here can extend into the software supply chain.
  • CISA KEV listing confirms active exploitation, so unpatched or unmitigated instances are a live target rather than a theoretical risk.

Now / Next / Later:

  • Now: Identify every TeamCity server and agent reachable from the internet or untrusted networks and restrict access to the agent polling endpoint to trusted hosts immediately.
  • Next: Apply the JetBrains fix for CVE-2026-63077 in the next available change window, checking the advisory for the exact fixed version for your deployment.
  • Later: Place TeamCity server and agent communication behind a VPN or allowlist by default, and build a routine to rotate credentials and secrets accessible via TeamCity after any suspected exposure.

Source