Summary
CVE-2026-63077 is a critical deserialization of untrusted data vulnerability in JetBrains TeamCity On-Premises. An unauthenticated attacker with HTTP(S) access to a vulnerable TeamCity server can abuse the agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.
Successful exploitation can expose TeamCity data, configurations, and stored credentials. It can also allow changes to server state and potentially compromise build artifacts and downstream CI/CD pipelines. The vulnerability affects TeamCity versions before 2025.11.7 and 2026.1.3. CISA added the vulnerability to its KEV catalog on August 5, 2026, after exploitation was observed in the wild.
Urgent Actions Required
- Upgrade TeamCity On-Premises to 2025.11.7 or 2026.1.3 immediately.
- Install JetBrains’ security patch plugin for TeamCity 2017.1 and later if an immediate upgrade is not possible.
- Restrict network access to TeamCity servers and use protective measures such as VPN access for internet-facing deployments.
- Review logs and investigate for compromise if a vulnerable TeamCity server was previously exposed to untrusted network access.
- Rotate stored credentials if there is a possibility that a vulnerable or compromised TeamCity server exposed them.
- Prioritize remediation because CVE-2026-63077 is now listed in CISA’s KEV catalog and has confirmed exploitation in the wild.
Which Systems Are Vulnerable to CVE-2026-63077?
Technical Overview
- Vulnerability Type:Unauthenticated Remote Code Execution via Deserialization of Untrusted Data
-
Affected Software/Versions:
- JetBrains TeamCity On-Premises versions before 2025.11.7 and 2026.1.3
-
CVSS Vector: v3.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Patch Availability: Yes, available
How Does the CVE-2026-63077 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2026-63077?
Vulnerability Root Cause:
CVE-2026-63077 is caused by unsafe deserialization of untrusted data in TeamCity’s agent polling protocol. TeamCity’s XStream configuration allowed TeamCity classes without first clearing its default permissions. This left the deserialization process overly permissive, allowing attacker-controlled data to bypass authentication checks and trigger arbitrary operating system command execution.
How Can You Mitigate CVE-2026-63077?
If immediate patching is delayed or not possible:
- Install JetBrains’ security patch plugin for TeamCity 2017.1 and later.
- Restrict network access to the TeamCity server and limit access to trusted users and systems.
- Place internet-facing TeamCity servers behind a VPN or additional protective access layer.
- Review TeamCity and relevant system logs for suspicious activity, especially if the server was exposed while unpatched.
- If compromise is suspected, rotate credentials stored in TeamCity, including affected access tokens and keys.
Which Assets and Systems Are at Risk?
-
Asset Types Affected:
- TeamCity On-Premises Servers - Versions before 2025.11.7 and 2026.1.3
- CI/CD Environments - Servers used for building, testing, and deploying software
-
Business-Critical Systems at Risk:
- TeamCity Data - Configurations and stored credentials
- CI/CD Pipelines - Build artifacts and downstream pipelines
-
Exposure Level:
- HTTP/HTTPS-Reachable Servers - Exploitable without authentication
- Unpatched On-Premises Deployments - Particularly at risk due to active exploitation
Will Patching CVE-2026-63077 Cause Downtime?
Patch application impact: Low. Upgrade to TeamCity 2025.11.7 or 2026.1.3. If upgrading is delayed, use JetBrains’ security patch plugin.
How Can You Detect CVE-2026-63077 Exploitation?
Exploitation Signatures:
Look for unusual HTTP(S) requests targeting the TeamCity agent polling protocol, especially from unknown sources.
Indicators of Compromise (IOCs/IOAs):
- Unexpected requests to TeamCity agent polling endpoints
- Unrecognized changes to TeamCity server state or build configurations
- Unexpected activity involving stored TeamCity credentials
- Unexpected outbound connections from the TeamCity server
Behavioral Indicators:
- Unexpected operating system commands executed by the TeamCity server process
- Unauthorized changes to build artifacts or CI/CD pipelines
Alerting Strategy:
- Priority: Critical
-
Trigger alerts for:
- Alert on suspicious requests to the agent polling protocol
- Alert on unexpected changes to build configurations or artifacts
- Investigate suspicious activity involving TeamCity credentials
Remediation & Response
-
Remediation Timeline:
- Immediate: Restrict network access to TeamCity servers.
- As soon as possible: Upgrade to 2025.11.7 or 2026.1.3.
- If upgrading is delayed: Install JetBrains’ security patch plugin.
-
Incident Response Considerations:
- Review TeamCity and relevant system logs for suspicious activity.
- Check for unauthorized server-state or build-configuration changes.
- Investigate potential exposure of stored credentials.
- Rotate affected credentials if compromise is suspected.
See How Fidelis NDR Delivers Full-Spectrum Network Security
-
-
- Gain deep visibility across ports and protocols
- Detect threats with network traffic and behavior analysis
- Correlate alerts to speed up investigation and response
- Strengthen protection with DLP, sandboxing, and threat intelligence
- Explore integrated deception and automated threat hunting
-
CVSS Breakdown Table
| Metric | Value | Description |
|---|---|---|
| Base Score | 9.8 | Critical vulnerability with high impact and remote exploitability |
| Attack Vector | Network | Exploitable remotely through HTTP/HTTPS access |
| Attack Complexity | Low | Exploitation does not require special conditions |
| Privileges Required | None | No authentication or prior privileges are required |
| User Interaction | None | Exploitation requires no user action |
| Scope | Unchanged | The impact remains within the vulnerable TeamCity component |
| Confidentiality Impact | High | Successful exploitation can expose TeamCity data, configurations, and stored credentials |
| Integrity Impact | High | Attackers can execute commands and potentially modify server state and CI/CD artifacts |
| Availability Impact | None | Arbitrary OS command execution can affect the availability of the TeamCity server |
References:
