Critical Deserialization Vulnerability in JetBrains TeamCity Exposed

What changed

On July 27, 2026, JetBrains announced a critical vulnerability, identified as CVE-2026-63077, which involves unsafe deserialization in TeamCity. This flaw permits attackers to exploit the agent polling protocol over HTTP or HTTPS, enabling them to execute operating system commands with the same privileges as the TeamCity server process.

Despite JetBrains reporting no known active exploitation at the time of disclosure, the situation escalated when CISA included this vulnerability in its (KEV) catalog on August 5, 2026, indicating confirmed exploitation in the wild.

Who is affected

The vulnerability primarily impacts users of JetBrains TeamCity, particularly those who have exposed their servers to the internet. The following groups are at risk:

Organizations that rely on TeamCity for continuous integration and deployment processes may face significant security threats due to this vulnerability.

• JetBrains TeamCity users
• Organizations utilizing continuous integration tools
• Development teams managing TeamCity servers
• Any entity with exposed TeamCity installations

What to do

To mitigate the risks associated with CVE-2026-63077, it is crucial for affected organizations to take immediate action. Users should ensure their TeamCity installations are updated to the latest version, where the vulnerability is addressed.

Additionally, implementing network security measures to restrict access to TeamCity servers can help prevent unauthorized exploitation.

• Update TeamCity to the latest version as soon as possible.
• Limit network access to TeamCity servers to trusted sources only.
• Regularly monitor security advisories from JetBrains and other relevant sources.
• Conduct security assessments to identify and remediate potential vulnerabilities.