> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-63077 — JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-63077-jetbrains-teamcity-jetbrains-teamcity-deserialization-of-untrusted-data-vulnerability/ - Published: 2026-08-05T21:22:30.000Z - Updated: 2026-08-05T21:22:30.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-63077 ## 1\. Executive summary CVE-2026-63077 is a critical (CVSS 9.8) deserialization of untrusted data vulnerability in JetBrains TeamCity On-Premises, enabling unauthenticated remote code execution (RCE) via the agent polling protocol. All On-Premises versions are affected; fixed versions are 2025.11.7 and 2026.1.3\. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalogue on 2026-08-05 with a remediation due date of 2026-08-08, and SSVC data was updated the same day to reflect active exploitation. EMEA financial services running self-hosted TeamCity face immediate risk of CI/CD pipeline compromise, credential theft, and downstream supply-chain impact. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | The vulnerability enables unauthenticated RCE on a CI/CD server that is fully automatable (CISA SSVC: automatable = yes), and CISA KEV confirms active exploitation. | Clients must treat this as a live resilience test: verify patch deployment and network segmentation controls against an actively exploited vector, not a theoretical one. | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | CISA KEV SSVC was updated on 2026-08-05 to reflect active exploitation of a CVSS 9.8 RCE on CI/CD infrastructure that can compromise pipeline integrity and stored credentials. | If a client's TeamCity instance is confirmed or suspected compromised, the incident likely meets the major-incident threshold and triggers DORA Art. 19 reporting timelines. | No specific NIS2 or UK NIS article is directly engaged beyond standard incident-response obligations, which are generic to any security incident and do not change client action specific to this item. ## 3\. Technical analysis & attack chain ### Confirmed attack chain (corroborated by NVD, Rapid7, SecurityWeek, The Hacker News, BleepingComputer) 1. **Initial access vector:** An unauthenticated remote attacker with HTTP(S) access to a TeamCity On-Premises server reaches the agent polling protocol endpoint. 2. **Authentication bypass:** The vulnerability (CWE-502 — deserialization of untrusted data) allows the attacker to bypass authentication checks via the agent polling protocol. No credentials or prior access are required. 3. **Code execution:** The deserialization flaw permits execution of arbitrary operating system commands with the privileges of the TeamCity server process. 4. **Post-exploitation impact:** JetBrains stated that attackers can read stored credentials and compromise CI/CD pipeline integrity. The full impact depends on the OS privileges granted to the TeamCity server process. ### Technical specifics - **Product:** JetBrains TeamCity On-Premises (all versions). TeamCity Cloud is not affected. - **Vulnerable component:** Agent polling protocol, accessible over HTTP(S). - **CWE:** CWE-502 (Deserialization of Untrusted Data), per NVD and JetBrains. - **CVSS:** 9.8 CRITICAL — vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (per NVD). - **EPSS:** 1% at time of KEV addition. Note: EPSS is low relative to the CVSS score and KEV status; this is not uncommon at the point of KEV addition and should not delay remediation. - **CISA SSVC:** Updated 2026-08-05 to exploitation = active, automatable = yes, technical impact = total. - **Affected versions (CPE):** `cpe:2.3:a:jetbrains:teamcity` — all versions up to (excluding) 2025.11.7; versions from (including) 2026.1 up to (excluding) 2026.1.3. - **Fixed versions:** TeamCity 2025.11.7 and TeamCity 2026.1.3. - **Alternative mitigation:** JetBrains security patch plugin available for TeamCity 2017.1 and later. The plugin addresses only CVE-2026-63077; JetBrains recommends upgrading to a fixed version for other security updates. **Attribution:** No threat actor is named in any source. Attribution is unconfirmed and not asserted. **Confidence caveat:** The active-exploitation determination rests on CISA's SSVC update and KEV catalogue entry (single authoritative source). No vendor report in the provided corpus independently confirms observed in-the-wild exploitation with IOCs or victim details. Treat "active exploitation" as credible (CISA is a high-confidence source) but uncorroborated by independent technical reporting at this time. ## 4\. Mitigation & containment ### P1 — within 24 hours (CISA KEV due date is 2026-08-08) 1. **Inventory and assess exposure:** Identify all TeamCity On-Premises instances. Determine whether any are internet-facing. The agent polling protocol should never be exposed to untrusted networks. 2. **Patch to a fixed version immediately:** \- Upgrade to **TeamCity 2025.11.7** or **TeamCity 2026.1.3** via the TeamCity UI update workflow or by downloading and installing the fixed version. - If upgrade is not possible within the KEV window, install the **JetBrains security patch plugin** (compatible with TeamCity 2017.1 and later) as an interim measure. This addresses only CVE-2026-63077. 3. **Restrict network access:** As a defence-in-depth measure, restrict HTTP(S) access to TeamCity servers to only authenticated users and systems that require it. Place TeamCity behind a VPN or IP-allowlisted reverse proxy. Block the agent polling protocol endpoint from untrusted source IPs at the network layer. 4. **If internet-exposed and unpatched:** Assume compromise. Perform forensic triage per CISA's Forensics Triage Requirements (referenced in the KEV entry). Look for unexpected child processes of the TeamCity server process, credential access, and pipeline modification. ### P2 — within 72 hours 1. **Validate patch deployment** across all instances using vulnerability scanning (Rapid7 InsightVM/Nexpose customers can use the vulnerability check released in the July 28 content release). 2. **Review TeamCity server process privileges:** Ensure the TeamCity server runs with the minimum necessary OS privileges to limit blast radius if exploitation occurs. 3. **Audit stored credentials:** Review and rotate any credentials, tokens, or secrets stored in or accessible via TeamCity, including CI/CD pipeline secrets, build agent credentials, and integration tokens. If any instance was internet-exposed while vulnerable, treat all stored secrets as potentially compromised. 4. **Review CI/CD pipeline integrity:** Check for unauthorised build configuration changes, new build agents, or modified deployment pipelines. ### P3 — within 7 days 1. **Confirm all instances are on a fixed version** (not relying on the plugin alone). 2. **Implement network segmentation** permanently: ensure TeamCity On-Premises is not internet-facing and the agent polling protocol is restricted to build agents only. 3. **Document the remediation** for DORA Art. 24 resilience-testing records. ## 5\. Indicators of compromise No indicators of compromise available in the source material. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------- | | Unauthenticated HTTP(S) requests to the agent polling protocol endpoint | TeamCity server access logs; WAF logs; network traffic to TeamCity HTTP(S) port | High — this is the confirmed exploitation vector | | Unexpected child processes spawned by the TeamCity server process (arbitrary OS command execution) | EDR process telemetry; OS audit logs | High — direct consequence of successful exploitation | | Access to or exfiltration of stored credentials and CI/CD secrets | EDR file access telemetry; secret management system access logs; network egress monitoring | Medium — JetBrains confirmed this is a post-exploitation capability | | Unauthorised modification of build configurations or pipeline definitions | TeamCity audit logs; CI/CD configuration change logs | Medium — JetBrains confirmed CI/CD pipeline integrity compromise as an impact | ## 6\. Detection Insufficient indicators to author detection rules. The sources describe the vulnerability mechanism and behavioural impact but do not provide specific artefacts (strings, file paths, command-line arguments, mutex names, registry keys, or network signatures) attributable to exploitation. The behavioural indicators in §5 should be used to build environment-specific detections in SIEM/EDR based on your TeamCity deployment's normal baseline. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | ---------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-63077](https://nvd.nist.gov/vuln/detail/CVE-2026-63077?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-08-05 | 1% | In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol | ## 7\. Sources - NVD, CVE-2026-63077 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-63077, accessed 2026-08-05 - CISA, Known Exploited Vulnerabilities Catalog — CVE-2026-63077, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-63077, added 2026-08-05 - Rapid7, CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity, https://www.rapid7.com/blog/post/etr-cve-2026-63077-critical-unauthenticated-remote-code-execution-in-jetbrains-teamcity, 2026-07-29 - Help Net Security, JetBrains fixes critical unauthenticated RCE in TeamCity On-Premises (CVE-2026-63077), https://www.helpnetsecurity.com/2026/07/28/teamcity-rce-cve-2026-63077-fixed/, 2026-07-28 - SecurityWeek, Critical Code Execution Vulnerability Patched in TeamCity, https://www.securityweek.com/critical-code-execution-vulnerability-patched-in-teamcity/, 2026-07-28 - The Hacker News, Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In, https://thehackernews.com/2026/07/critical-teamcity-flaw-could-let.html, 2026-07-28 - BleepingComputer, JetBrains warns of critical TeamCity remote code execution flaw, https://www.bleepingcomputer.com/news/security/jetbrains-warns-of-critical-teamcity-remote-code-execution-flaw/, 2026-07-28 - BSI Germany, WID-SEC-2026-2504: JetBrains TeamCity: Mehrere Schwachstellen ermöglichen Codeausführung, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2504, 2026-07-28 ## 8\. Adverse Trace position **Severity: CRITICAL (CVSS 9.8).** This is a confirmed unauthenticated RCE in a widely deployed CI/CD platform with CISA KEV listing and active exploitation confirmed as of 2026-08-05\. The KEV remediation due date is 2026-08-08 — three days from issuance of this advisory. EMEA financial services clients running TeamCity On-Premises must treat this as an emergency: patch to 2025.11.7 or 2026.1.3, restrict network exposure of the agent polling protocol, and rotate stored credentials on any instance that was internet-facing while vulnerable. The active-exploitation determination is CISA-sourced and credible but not independently corroborated by technical vendor reporting with IOCs in the available corpus; we are monitoring for emergence of exploitation artefacts and will issue an update if IOCs or actor attribution become available. Clients should also assess whether any CI/CD pipeline compromise has occurred via retrospective review of build configuration changes and deployment logs. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-63077?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*