CVE-2026-63077

Published Jul 27, 2026

Last updated 2 months ago

Exploit known CVSS critical 9.8

Cloud

Supply chain

JetBrains TeamCity

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-63077 is an unauthenticated remote code execution vulnerability affecting JetBrains TeamCity On-Premises versions prior to 2026.1.3 and 2025.11.7. This flaw, categorized as a deserialization of untrusted data (CWE-502), resides within the TeamCity agent polling protocol. An attacker with network access to the TeamCity server can exploit this vulnerability to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. The root cause involves an issue with the XStream class type permission reset, which results in an overly permissive allowlist for deserialization.

Description: In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
Source: cve@jetbrains.com
NVD status: Analyzed
Products: teamcity

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
Exploit added on: Aug 5, 2026
Exploit action due: Aug 8, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

cve@jetbrains.com: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "4F865D53-6163-4A62-B8C1-06F45DA28E3C",
            "versionEndExcluding": "2025.11.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "4CD39F06-B4AA-4300-B763-9362E98D50D6",
            "versionEndExcluding": "2026.1.3",
            "versionStartIncluding": "2026.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.