Vulnerability · CVE-2026-63077

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Published Jul 27, 2026 · catalog updated Aug 5, 2026 · JetBrains TeamCity

Patch now

CVE-2026-63077 is in the CISA known-exploited catalog, due Aug 8, 2026. Confirm JetBrains TeamCity against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Gaps on this record

No version range is stored. A customer cannot check an installed version against this record.

Severity: Critical9.8
Known exploitation: CISA KEV and VulnCheck KEV
EPSS: 89.57%
Remediation: Remediation guidance
Affected products: cpe jetbrains/teamcity · vendor JetBrains TeamCity

Overview On July 27, 2026, JetBrains published a security advisory for CVE-2026-63077 , a critical unsafe deserialization vulnerability affecting JetBrains TeamCity . An attacker who can reach a TeamCity server over HTTP or HTTPS can exploit the agent polling protocol without credentials and execute operating system commands with the privileges of the TeamCity server process. JetBrains reported no known active exploitation when it disclosed the vulnerability. However, on August 5, 2026, CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog, confirming exploitation in t

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

cpe jetbrains/teamcityversion unspecified
vendor JetBrains TeamCityversion unspecified

How to fix CVE-2026-63077

Recommended remediation
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA due date Aug 8, 2026.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2026-63077 is in the CISA known-exploited catalog, due Aug 8, 2026. Confirm JetBrains TeamCity against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Affected version ranges are not on this record. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

What should an analyst verify?

CWE-502: Deserialization of Untrusted Data. EPSS 89.57%. The CISA KEV listing is the exploitation evidence. A public exploit reference is linked in Sources. That is not the same as confirmed exploitation. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Jul 27, 2026 · Catalog
Detected
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
Aug 5, 2026 · CISA KEV
Known exploited
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating
Aug 5, 2026 · Catalog
Updated
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
Aug 8, 2026 · CISA KEV
Remediation due
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

Sources

CISA KEVConfirmed exploitationCVE-2026-63077
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
cisa.gov
CVE.orgVulnerability recordCVE-2026-63077
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-63077
30-day exploitation probability 89.6%
first.org
Metasploit ModulesPublic exploit moduleexploit_multi/http/jetbrains_teamcity_rce_cve_2026_63077
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com
NIST NVDVulnerability recordCVE-2026-63077
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
nvd.nist.gov
Rapid7 Vulnerability DatabaseResearchCVE-2026-63077
Overview On July 27, 2026, JetBrains published a security advisory for CVE-2026-63077 , a critical unsafe deserialization vulnerability affecting JetBrains TeamCity . An attacker who can reach a TeamCity server over HTTP or HTTPS can exploit the agent polling protocol without credentials and execute operating system commands with the privileges of the TeamCity server process. JetBrains reported no
rapid7.com
VulnCheck KEVConfirmed exploitationCVE-2026-63077
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
vulncheck.com

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

Priority score

73/100

Evidence confidence: Very high

CISA lists this vulnerability as known to be exploited.

Confirmed exploitation30/30
EPSS probability18/20
CVSS severity15/15
Public exploit10/10
Internet exposure0/10
Product prevalence0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Critical

CVSS severity
9.8 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS probability
89.57% · p99.79%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
Yes · CISA KEV and VulnCheck KEV
CISA KEV since Aug 5, 2026. Ransomware use: Known.
Patch availability
Remediation guidance
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Stacks

TeamCity

Weakness

CWE-502
Deserialization of Untrusted Data
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.