CVE-2026-63077: How a TeamCity Deserialization Flaw Opens the Door to RCE - USA Social Bookmarking Website

CVE-2026-63077: How a TeamCity Deserialization Flaw Opens the Door to RCE fidelissecurity.com

CVE-2026-63077 is a critical deserialization of untrusted data vulnerability in JetBrains TeamCity On-Premises. An unauthenticated attacker with HTTP(S) access to a vulnerable TeamCity server can abuse the agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.

Successful exploitation can expose TeamCity data, configurations, and stored credentials. It can also allow changes to server state and potentially compromise build artifacts and downstream CI/CD pipelines. The vulnerability affects TeamCity versions before 2025.11.7 and 2026.1.3. CISA added the vulnerability to its KEV catalog on August 5, 2026, after exploitation was observed in the wild.

Urgent Actions Required

Upgrade TeamCity On-Premises to 2025.11.7 or 2026.1.3 immediately.
Install JetBrains’ security patch plugin for TeamCity 2017.1 and later if an immediate upgrade is not possible.
Restrict network access to TeamCity servers and use protective measures such as VPN access for internet-facing deployments.
Review logs and investigate for compromise if a vulnerable TeamCity server was previously exposed to untrusted network access.
Rotate stored credentials if there is a possibility that a vulnerable or compromised TeamCity server exposed them.
Prioritize remediation because CVE-2026-63077 is now listed in CISA’s KEV catalog and has confirmed exploitation in the wild.

Which Systems Are Vulnerable to CVE-2026-63077?

Technical Overview

Vulnerability Type:Unauthenticated Remote Code Execution via Deserialization of Untrusted Data
Affected Software/Versions:
- JetBrains TeamCity On-Premises versions before 2025.11.7 and 2026.1.3
CVSS Vector: v3.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

What Causes CVE-2026-63077?

Vulnerability Root Cause:

CVE-2026-63077 is caused by unsafe deserialization of untrusted data in TeamCity’s agent polling protocol. TeamCity’s XStream configuration allowed TeamCity classes without first clearing its default permissions. This left the deserialization process overly permissive, allowing attacker-controlled data to bypass authentication checks and trigger arbitrary operating system command execution.