An unauthenticated attacker who can reach a TeamCity server’s agent polling endpoint can trigger deserialization of malicious data and run arbitrary code on the server, with no login required.