CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

CVE-2026-63077 is a deserialization of untrusted data vulnerability in JetBrains TeamCity that can allow unauthenticated remote code execution through the agent polling protocol. For IT and security teams running TeamCity as a CI/CD platform, this matters because successful abuse can give an attacker code execution on the server without prior authentication, putting build infrastructure, secrets, and connected systems at risk.

Public detail is limited to the vulnerability class and impact described above. Confirm exact affected builds, fixed releases, and deployment-specific notes against the vendor advisory before acting.

How it works

This issue is classed as CWE-502: deserialization of untrusted data. In products that accept serialized objects over a network protocol, the application may reconstruct objects from attacker-controlled input without sufficient validation. If that reconstruction can trigger dangerous object graphs or gadget chains, the result can be arbitrary code execution in the context of the TeamCity process.

According to the CISA summary, the flaw is reachable via the agent polling protocol and does not require authentication. An attacker who can reach that protocol endpoint may send crafted data that the server deserializes unsafely, leading to remote code execution. Specific exploit mechanics, payloads, or preconditions beyond this description are not provided in the given facts; treat any deeper technical claims as unconfirmed until verified against the vendor advisory and your own testing in a lab.

Am I affected? How to find it in your systems

JetBrains TeamCity is commonly deployed as an on-premises or self-hosted CI/CD server, often on internal networks but sometimes exposed to the internet for remote agents or integrations. Inventory every TeamCity server instance, including secondary nodes, disaster-recovery copies, and containers or VMs used for evaluation.

• Search asset inventories, CMDB records, software bills of materials, and package or container registries for TeamCity installations.
• Identify hosts listening on TeamCity’s typical web and agent-related ports; confirm whether the agent polling protocol is reachable from untrusted networks.
• Compare installed product versions and build numbers to the fixed releases listed in the JetBrains advisory—do not rely on version guesses from this article.
• Review network diagrams and firewall rules for paths that allow unauthenticated clients to reach agent communication endpoints.
• For exploitation signs, inspect TeamCity server logs, agent connection logs, and host EDR/telemetry for unexpected process creation, unusual deserialization-related errors, or inbound connections to agent polling interfaces from unknown sources. Specific IoCs are not provided in the given facts; align monitoring with vendor guidance when published.

How to remediate

Patch first. Apply the vendor-supplied update for CVE-2026-63077 as named in the JetBrains TeamCity advisory, and verify the installed build matches a fixed release. Follow CISA’s direction to apply mitigations per vendor instructions and to align with BOD 26-04 prioritization and forensics triage requirements where they apply to your environment. For cloud-hosted or managed instances, follow applicable BOD 26-04 cloud guidance or discontinue use if mitigations cannot be applied.

• Schedule and deploy the official TeamCity update across all instances; re-check version strings after upgrade.
• Restrict network exposure of the server and agent protocols to only trusted build agents and administrators.
• Ensure TeamCity runs with least privilege, separate service accounts, and hardened OS baselines so post-exploitation impact is limited.
• Rotate credentials, tokens, and secrets that the TeamCity server could access, especially if the instance was internet-facing before patching.
• Re-validate backup integrity and recovery procedures for the CI/CD platform after remediation.

If you can't patch immediately

Until the vendor update is installed, reduce exposure with compensating controls appropriate to an unauthenticated RCE on a CI/CD server.

• Segment TeamCity so the agent polling protocol and management interfaces are unreachable from the internet and from untrusted internal segments; allow only known agent IPs or networks.
• Place a reverse proxy or WAF in front of exposed HTTP interfaces and block or tightly restrict paths and methods related to agent communication if your vendor or WAF vendor provides virtual-patch rules—confirm rule efficacy rather than assuming coverage for deserialization flaws.
• Temporarily disable or isolate remote agent registration and polling features if operationally feasible and documented as safe by JetBrains for your version.
• Increase monitoring and alerting on TeamCity process trees, new outbound connections, and authentication-adjacent logs; forward logs to a SIEM and retain them for incident response.
• If mitigations are unavailable and exposure cannot be removed, plan to take the service offline or replace it until a patch can be applied, consistent with CISA’s guidance on discontinuing use when necessary.

If your data may have been exposed

Actively exploited remote code execution flaws on build servers can lead to theft of source code, pipeline secrets, cloud credentials, and downstream compromise. Known ransomware use is not documented for this CVE in the provided facts; still treat any confirmed exploitation as a potential breach. Preserve logs and disk images per your incident response plan and CISA forensics triage expectations, rotate secrets the server could reach, and review agent and pipeline trust relationships. You can run a free exposure scan of your email addresses against known breach datasets to see whether associated credentials or identities appear in prior public breaches while you complete internal investigation.