CVE-2026-63077

Published Jul 27, 2026

Last updated 3 days ago

Exploit known CVSS critical 9.8

JetBrains TeamCity

Overview

Description: In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
Source: cve@jetbrains.com
NVD status: Analyzed
Products: teamcity

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
Exploit added on: Aug 5, 2026
Exploit action due: Aug 8, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

cve@jetbrains.com: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "4F865D53-6163-4A62-B8C1-06F45DA28E3C",
            "versionEndExcluding": "2025.11.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "4CD39F06-B4AA-4300-B763-9362E98D50D6",
            "versionEndExcluding": "2026.1.3",
            "versionStartIncluding": "2026.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References