vuln.management
Act nowKnown exploited

Advisory · CVE-2026-63077

TeamCity unauthenticated RCE is in CISA KEV

CISA reports that unsafe deserialization in the TeamCity agent polling protocol can permit unauthenticated remote code execution.

Advisory published July 27, 2026Independent summary
Vendor
JetBrains
Product
TeamCity
Identifier / CWE
CVE-2026-63077
CWE-502
Action timing
Aug 8, 2026
ELI5

Explain it like I’m five

TeamCity opens a package from someone it has not authenticated and trusts the instructions packed inside. The package can make the build server run the attacker's code.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Agent request

    An unauthenticated attacker reaches the TeamCity agent polling protocol.

  2. 02Hostile object

    The request contains serialized data controlled by the attacker.

  3. 03Unsafe unpacking

    TeamCity deserializes the object and triggers attacker-selected behavior.

  4. 04Server code execution

    The attacker can run code where builds, tokens, and deployment trust live.

What happened

CISA added CVE-2026-63077 to the Known Exploited Vulnerabilities catalog on August 5, 2026. The catalog describes deserialization of untrusted data in the TeamCity agent polling protocol that can allow unauthenticated remote code execution.

Build systems frequently hold source access, signing material, deployment credentials, package-registry tokens, and trusted relationships with production environments. The consequence of compromise can extend well beyond the TeamCity server itself.

What to do

  1. Identify every TeamCity server and confirm its deployed version from the running system.
  2. Follow JetBrains guidance for fixed releases and any required mitigation.
  3. Restrict unnecessary access to TeamCity services while remediation is underway.
  4. Review administrator changes, new or modified agents, build configurations, plugins, tokens, and unusual build activity.
  5. Assess secrets and downstream systems accessible to the server and its agents.
  6. If compromise is suspected, preserve evidence before rebuilding and rotate exposed credentials from a trusted environment.
  7. Verify the updated version and test the intended access boundary after the change.

Management note

CISA’s required-action date is August 8, 2026 for covered agencies. Because exploitation is known and CI/CD systems are highly privileged, affected environments deserve both emergency remediation and evidence-led compromise assessment.

Use JetBrains documentation as the source of truth for affected and fixed versions.