CVE-2026-63077
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
Description
CVE-2026-63077 is a critical unauthenticated remote code execution vulnerability in JetBrains TeamCity caused by insecure deserialization of untrusted data in the agent polling protocol. TeamCity is a widely deployed continuous integration and build server, so an attacker who reaches the agent polling protocol can execute arbitrary code on the build server without any credentials. Because exploitation requires no authentication, no privileges, and no user interaction, and results in full compromise of the host, CVE-2026-63077 carries a CVSS 3.1 score of 9.8. CISA has added it to the Known Exploited Vulnerabilities catalog, confirming active exploitation and making prompt upgrade of TeamCity an urgent priority.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| jetbrains | teamcity | < 2025.11.7; >= 2026.1, < 2026.1.3 |
References
- https://www.jetbrains.com/privacy-security/issues-fixed/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
Deserialization of untrusted data occurs when an application reconstructs objects from data it receives without sufficiently verifying that the data is valid and safe, allowing an attacker who controls the serialized input to trigger dangerous operations. In CVE-2026-63077, the TeamCity agent polling protocol deserializes attacker-controlled data, enabling unauthenticated remote code execution on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
The impact of CVE-2026-63077 is severe: with an attack vector of network, the flaw is remotely exploitable without physical access, and with low attack complexity it can be triggered without special conditions. No privileges and no user interaction are required, so an unauthenticated attacker who can reach the agent polling protocol can exploit it directly. The high impact to confidentiality, integrity, and availability means the attacker can read secrets stored on the build server, tamper with builds and artifacts, and disrupt the CI/CD pipeline — a particularly dangerous outcome given TeamCity's central role in software delivery and its access to source code, credentials, and deployment systems. Rated CVSS 9.8 (Critical) with an EPSS score of roughly 11% (95th percentile) and active exploitation confirmed by CISA, this vulnerability should be remediated immediately.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-63077 by adding it to the Known Exploited Vulnerabilities catalog, so defenders should assume this deserialization flaw is being exploited against exposed TeamCity servers. The EPSS score of roughly 11% (95th percentile) indicates a high probability of exploitation activity relative to the broader vulnerability landscape. JetBrains has published its fix in the vendor's security bulletin, and while the KEV ransomware flag is currently "Unknown," the combination of unauthenticated network reach, a CVSS score of 9.8, and confirmed in-the-wild use makes immediate patching essential. Given the low complexity and the high value of CI/CD infrastructure as a target, working exploit techniques should be presumed to exist.
Remediation
- Apply the JetBrains fix immediately. Following CISA's KEV required action, apply mitigations per JetBrains' instructions and comply with BOD 26-04 guidance; if a fix cannot be applied, discontinue use of the affected server.
- Upgrade TeamCity to a patched release — at least version 2025.11.7 for the 2025.11 line, or 2026.1.3 for the 2026.1 line, which fix the deserialization flaw in the agent polling protocol.
- Restrict network exposure of the build server by placing TeamCity behind a VPN or firewall so that the agent polling protocol is reachable only from trusted build agents and management networks, not the open internet.
- Rotate secrets and credentials stored in or accessible from TeamCity (source-control tokens, deployment keys, service accounts) if you cannot confirm the server was not exploited before patching.
- Review logs and audit builds for indicators of compromise, including unexpected agent connections, anomalous build behavior, and unauthorized configuration or artifact changes, and treat a compromised build server as a supply-chain risk.
Technical Details
CVE-2026-63077 is a deserialization of untrusted data vulnerability (CWE-502) in the JetBrains TeamCity agent polling protocol. Serialization converts objects into a transportable format and deserialization reconstructs them; when attacker-controlled serialized data is deserialized without validation, the attacker can instantiate arbitrary objects or trigger dangerous operations during reconstruction, which in this case yields remote code execution. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, meaning an attacker can achieve code execution simply by sending crafted data to the exposed agent polling endpoint. Deserialization flaws are consistently among the most severe because they routinely enable unauthenticated code execution, and TeamCity's position in the build pipeline amplifies the blast radius.
Frequently Asked Questions
Is CVE-2026-63077 being actively exploited?
Yes. CISA has added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Its EPSS score of about 11% (95th percentile) further indicates a high likelihood of ongoing exploitation activity, though the ransomware association is currently unknown.
What products are affected by CVE-2026-63077?
The vulnerability affects JetBrains TeamCity versions before 2025.11.7, as well as the 2026.1 line up to but not including 2026.1.3. Servers running these versions with a reachable agent polling protocol are at risk.
How do I fix CVE-2026-63077?
Upgrade TeamCity to a patched release — 2025.11.7 or 2026.1.3 — following JetBrains' guidance and CISA's KEV instructions under BOD 26-04. Until patched, restrict network access so the agent polling protocol is reachable only from trusted agents, and rotate any secrets that may have been exposed.
How severe is CVE-2026-63077?
It is Critical, with a CVSS 3.1 base score of 9.8. The vulnerability is unauthenticated, network-exploitable, requires no user interaction, and causes high confidentiality, integrity, and availability impact; combined with an EPSS score in the 95th percentile and its impact on CI/CD infrastructure, it is one of the highest-priority vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.