~/f4n6 $ grep -r "CVE-2026-63077 — JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability" ./investigations/ --include="*.md"

CVE-2026-63077 — JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Jeff Davies 05 Aug 2026 6 min read

1. Executive summary

CVE-2026-63077 is a critical (CVSS 9.8) deserialization of untrusted data vulnerability in JetBrains TeamCity On-Premises, enabling unauthenticated remote code execution (RCE) via the agent polling protocol. All On-Premises versions are affected; fixed versions are 2025.11.7 and 2026.1.3. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalogue on 2026-08-05 with a remediation due date of 2026-08-08, and SSVC data was updated the same day to reflect active exploitation. EMEA financial services running self-hosted TeamCity face immediate risk of CI/CD pipeline compromise, credential theft, and downstream supply-chain impact.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 24: digital operational resilience testing — general requirements The vulnerability enables unauthenticated RCE on a CI/CD server that is fully automatable (CISA SSVC: automatable = yes), and CISA KEV confirms active exploitation. Clients must treat this as a live resilience test: verify patch deployment and network segmentation controls against an actively exploited vector, not a theoretical one.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities CISA KEV SSVC was updated on 2026-08-05 to reflect active exploitation of a CVSS 9.8 RCE on CI/CD infrastructure that can compromise pipeline integrity and stored credentials. If a client's TeamCity instance is confirmed or suspected compromised, the incident likely meets the major-incident threshold and triggers DORA Art. 19 reporting timelines.

No specific NIS2 or UK NIS article is directly engaged beyond standard incident-response obligations, which are generic to any security incident and do not change client action specific to this item.

3. Technical analysis & attack chain

Confirmed attack chain (corroborated by NVD, Rapid7, SecurityWeek, The Hacker News, BleepingComputer)

  1. Initial access vector: An unauthenticated remote attacker with HTTP(S) access to a TeamCity On-Premises server reaches the agent polling protocol endpoint.
  2. Authentication bypass: The vulnerability (CWE-502 — deserialization of untrusted data) allows the attacker to bypass authentication checks via the agent polling protocol. No credentials or prior access are required.
  3. Code execution: The deserialization flaw permits execution of arbitrary operating system commands with the privileges of the TeamCity server process.
  4. Post-exploitation impact: JetBrains stated that attackers can read stored credentials and compromise CI/CD pipeline integrity. The full impact depends on the OS privileges granted to the TeamCity server process.

Technical specifics

  • Product: JetBrains TeamCity On-Premises (all versions). TeamCity Cloud is not affected.
  • Vulnerable component: Agent polling protocol, accessible over HTTP(S).
  • CWE: CWE-502 (Deserialization of Untrusted Data), per NVD and JetBrains.
  • CVSS: 9.8 CRITICAL — vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (per NVD).
  • EPSS: 1% at time of KEV addition. Note: EPSS is low relative to the CVSS score and KEV status; this is not uncommon at the point of KEV addition and should not delay remediation.
  • CISA SSVC: Updated 2026-08-05 to exploitation = active, automatable = yes, technical impact = total.
  • Affected versions (CPE): cpe:2.3:a:jetbrains:teamcity — all versions up to (excluding) 2025.11.7; versions from (including) 2026.1 up to (excluding) 2026.1.3.
  • Fixed versions: TeamCity 2025.11.7 and TeamCity 2026.1.3.
  • Alternative mitigation: JetBrains security patch plugin available for TeamCity 2017.1 and later. The plugin addresses only CVE-2026-63077; JetBrains recommends upgrading to a fixed version for other security updates.

Attribution: No threat actor is named in any source. Attribution is unconfirmed and not asserted.

Confidence caveat: The active-exploitation determination rests on CISA's SSVC update and KEV catalogue entry (single authoritative source). No vendor report in the provided corpus independently confirms observed in-the-wild exploitation with IOCs or victim details. Treat "active exploitation" as credible (CISA is a high-confidence source) but uncorroborated by independent technical reporting at this time.

4. Mitigation & containment

P1 — within 24 hours (CISA KEV due date is 2026-08-08)

  1. Inventory and assess exposure: Identify all TeamCity On-Premises instances. Determine whether any are internet-facing. The agent polling protocol should never be exposed to untrusted networks.
  2. Patch to a fixed version immediately: - Upgrade to TeamCity 2025.11.7 or TeamCity 2026.1.3 via the TeamCity UI update workflow or by downloading and installing the fixed version. - If upgrade is not possible within the KEV window, install the JetBrains security patch plugin (compatible with TeamCity 2017.1 and later) as an interim measure. This addresses only CVE-2026-63077.
  3. Restrict network access: As a defence-in-depth measure, restrict HTTP(S) access to TeamCity servers to only authenticated users and systems that require it. Place TeamCity behind a VPN or IP-allowlisted reverse proxy. Block the agent polling protocol endpoint from untrusted source IPs at the network layer.
  4. If internet-exposed and unpatched: Assume compromise. Perform forensic triage per CISA's Forensics Triage Requirements (referenced in the KEV entry). Look for unexpected child processes of the TeamCity server process, credential access, and pipeline modification.

P2 — within 72 hours

  1. Validate patch deployment across all instances using vulnerability scanning (Rapid7 InsightVM/Nexpose customers can use the vulnerability check released in the July 28 content release).
  2. Review TeamCity server process privileges: Ensure the TeamCity server runs with the minimum necessary OS privileges to limit blast radius if exploitation occurs.
  3. Audit stored credentials: Review and rotate any credentials, tokens, or secrets stored in or accessible via TeamCity, including CI/CD pipeline secrets, build agent credentials, and integration tokens. If any instance was internet-exposed while vulnerable, treat all stored secrets as potentially compromised.
  4. Review CI/CD pipeline integrity: Check for unauthorised build configuration changes, new build agents, or modified deployment pipelines.

P3 — within 7 days

  1. Confirm all instances are on a fixed version (not relying on the plugin alone).
  2. Implement network segmentation permanently: ensure TeamCity On-Premises is not internet-facing and the agent polling protocol is restricted to build agents only.
  3. Document the remediation for DORA Art. 24 resilience-testing records.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

Behaviour Where to observe Confidence
Unauthenticated HTTP(S) requests to the agent polling protocol endpoint TeamCity server access logs; WAF logs; network traffic to TeamCity HTTP(S) port High — this is the confirmed exploitation vector
Unexpected child processes spawned by the TeamCity server process (arbitrary OS command execution) EDR process telemetry; OS audit logs High — direct consequence of successful exploitation
Access to or exfiltration of stored credentials and CI/CD secrets EDR file access telemetry; secret management system access logs; network egress monitoring Medium — JetBrains confirmed this is a post-exploitation capability
Unauthorised modification of build configurations or pipeline definitions TeamCity audit logs; CI/CD configuration change logs Medium — JetBrains confirmed CI/CD pipeline integrity compromise as an impact

6. Detection

Insufficient indicators to author detection rules.

The sources describe the vulnerability mechanism and behavioural impact but do not provide specific artefacts (strings, file paths, command-line arguments, mutex names, registry keys, or network signatures) attributable to exploitation. The behavioural indicators in §5 should be used to build environment-specific detections in SIEM/EDR based on your TeamCity deployment's normal baseline.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

CVE CVSS Exploited EPSS Summary
CVE-2026-63077 9.8 Critical ⚠ KEV 2026-08-05 1% In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

7. Sources

  • NVD, CVE-2026-63077 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-63077, accessed 2026-08-05
  • CISA, Known Exploited Vulnerabilities Catalog — CVE-2026-63077, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077, added 2026-08-05
  • Rapid7, CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity, https://www.rapid7.com/blog/post/etr-cve-2026-63077-critical-unauthenticated-remote-code-execution-in-jetbrains-teamcity, 2026-07-29
  • Help Net Security, JetBrains fixes critical unauthenticated RCE in TeamCity On-Premises (CVE-2026-63077), https://www.helpnetsecurity.com/2026/07/28/teamcity-rce-cve-2026-63077-fixed/, 2026-07-28
  • SecurityWeek, Critical Code Execution Vulnerability Patched in TeamCity, https://www.securityweek.com/critical-code-execution-vulnerability-patched-in-teamcity/, 2026-07-28
  • The Hacker News, Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In, https://thehackernews.com/2026/07/critical-teamcity-flaw-could-let.html, 2026-07-28
  • BleepingComputer, JetBrains warns of critical TeamCity remote code execution flaw, https://www.bleepingcomputer.com/news/security/jetbrains-warns-of-critical-teamcity-remote-code-execution-flaw/, 2026-07-28
  • BSI Germany, WID-SEC-2026-2504: JetBrains TeamCity: Mehrere Schwachstellen ermöglichen Codeausführung, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2504, 2026-07-28

8. Adverse Trace position

Severity: CRITICAL (CVSS 9.8). This is a confirmed unauthenticated RCE in a widely deployed CI/CD platform with CISA KEV listing and active exploitation confirmed as of 2026-08-05. The KEV remediation due date is 2026-08-08 — three days from issuance of this advisory. EMEA financial services clients running TeamCity On-Premises must treat this as an emergency: patch to 2025.11.7 or 2026.1.3, restrict network exposure of the agent polling protocol, and rotate stored credentials on any instance that was internet-facing while vulnerable. The active-exploitation determination is CISA-sourced and credible but not independently corroborated by technical vendor reporting with IOCs in the available corpus; we are monitoring for emergence of exploitation artefacts and will issue an update if IOCs or actor attribution become available. Clients should also assess whether any CI/CD pipeline compromise has occurred via retrospective review of build configuration changes and deployment logs.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies