JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
  • Highest CVSS: 9.8 (Critical).
  • Listed in CISA KEV (2026-08-05) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-63077.

What it is

CVE-2026-63077 is a deserialisation of untrusted data vulnerability in JetBrains TeamCity. It sits in the agent polling protocol, which handles communication between TeamCity build agents and the server.

The flaw allows unauthenticated remote code execution over the network. An attacker does not need credentials or any prior access to the TeamCity server or agents to reach the vulnerable code path — it’s exploitable directly against the polling mechanism. Given the CVSS vector (AV:N/AC:L/PR:N/UI:N), no user interaction is required and complexity is low.

The impact is complete: confidentiality, integrity and availability are all rated high. Successful exploitation gives an attacker code execution on the affected system, with no indication that the flaw is limited to a subset of functionality or data.

This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-08-05, so it is known to be exploited.

What to do

  • Treat this as urgent. A CVSS score of 9.8, unauthenticated RCE, and CISA KEV listing together mean this should be at the top of the patching queue.
  • Check the JetBrains advisory directly for fixed releases, as none are listed here yet — confirm the exact version your instance should be upgraded to before acting.
  • If a fix is not yet available for your version, restrict network access to the TeamCity server and agent polling endpoints to trusted hosts only, as an interim mitigation.
  • Review TeamCity server and agent logs for anomalous activity around the agent polling protocol, particularly since KEV listing.
  • If TeamCity is internet-facing, consider taking it offline or placing it behind a VPN/allowlist until patched, given the low bar for exploitation.
  • Once patched, rotate any credentials or secrets stored in or accessible via TeamCity, as a precaution given the RCE impact.

For leadership 🧭

Executive summary. Risk is Critical (CVSS 9.8) across any JetBrains kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source