# CVE-2026-63077: JetBrains TeamCity RCE via Deserialization

> CISA adds CVE-2026-63077 to KEV, indicating active exploitation of a JetBrains TeamCity deserialization RCE vulnerability.

- Published: 2026-08-11T16:54:33.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: CVE-2026-63077, JetBrains TeamCity, Deserialization, Remote Code Execution, CISA KEV
- CVEs: CVE-2026-63077
- Author: Runtime Rebel Intel
- Primary source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63077
- Canonical: https://runtimerebel.com/blog/cve-2026-63077-jetbrains-teamcity-rce-via-deserialization

## Key points

- Unauthenticated remote code execution vulnerability in JetBrains TeamCity is actively exploited in the wild.
- Affected systems include JetBrains TeamCity installations vulnerable to deserialization of untrusted data via the agent polling protocol.
- Defenders must apply vendor mitigations immediately or discontinue use of affected products per CISA BOD 26-04.

## Critical: [CVE](/glossary#cve)-2026-63077 Actively Exploited in JetBrains TeamCity

The [Cybersecurity and Infrastructure Security Agency (CISA)](/glossary#cybersecurity-and-infrastructure-security-agency-cisa) has added [CVE-2026-63077](/cve/cve-2026-63077) to its Known Exploited Vulnerabilities ([KEV](/glossary#kev)) Catalog. This addition, made on August 5, 2026, confirms active, in-the-wild exploitation of a critical deserialization of untrusted data [vulnerability](/glossary#vulnerability) in JetBrains TeamCity. The vulnerability, identified as [CWE](/glossary#cwe)-502, allows for unauthenticated remote code execution ([RCE](/glossary#rce)) via the agent polling protocol, posing an immediate and severe threat to organizations utilizing this Continuous Integration/Continuous Delivery ([CI/CD](/glossary#ci-cd)) platform, according to [CISA](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63077).

### Understanding the Unauthenticated Remote Code Execution in JetBrains TeamCity

[CVE-2026-63077](https://nvd.nist.gov/vuln/detail/CVE-2026-63077) stems from a deserialization of untrusted data flaw within JetBrains TeamCity. Deserialization vulnerabilities occur when an application deserializes data from an untrusted source without proper validation, which can allow attackers to inject malicious code or objects. In this specific instance, the weakness impacts the agent polling protocol, a mechanism TeamCity agents use to communicate with the TeamCity server. The critical aspect of this flaw is that it enables unauthenticated remote code execution, meaning an attacker does not need to possess valid credentials or prior access to [exploit](/glossary#exploit) it.

Exploiting such a vulnerability in a CI/CD system like TeamCity can have far-reaching consequences. CI/CD pipelines are central to software development and deployment, often having elevated permissions to access source code repositories, artifact stores, and production environments. A successful RCE exploit could allow an attacker to gain full control over the TeamCity server, manipulate build processes, inject malicious code into deployed applications, exfiltrate sensitive intellectual property, or use the compromised server as a pivot point into broader corporate networks.

### Impact and CISA's Directive

CISA's inclusion of [CVE-2026-63077](https://nvd.nist.gov/vuln/detail/CVE-2026-63077) in its KEV Catalog signifies that federal agencies are mandated to remediate this vulnerability by August 8, 2026, under Binding Operational Directive (BOD) 26-04. This directive emphasizes the critical nature of the flaw and the confirmed threat it poses. While primarily aimed at federal agencies, BOD 26-04 serves as an urgent warning for all organizations to prioritize patching and mitigation efforts. Organizations must evaluate their exposure, particularly internet-facing TeamCity instances, as the unauthenticated nature of the exploit bypasses many initial layers of defense.

### Actionable Recommendations: Patching and Mitigating CVE-2026-63077

Given the confirmed active exploitation and the severity of **unauthenticated remote code execution in JetBrains TeamCity**, immediate action is paramount. Defenders should prioritize the following:

*   **Apply Vendor Mitigations/Patches**: The most crucial step is to apply all available security updates or mitigations provided by JetBrains. Organizations must consult the official vendor advisories for specific patching guidance.
*   **CISA BOD 26-04 Compliance**: Federal agencies must adhere strictly to BOD 26-04 guidance, which includes applying mitigations or discontinuing use of the product if mitigations are unavailable. This also entails following CISA’s “Forensics Triage Requirements” in the event of suspected compromise.
*   **Evaluate Internet Exposure**: Assess all JetBrains TeamCity instances for internet accessibility. Instances directly exposed to the internet are at the highest risk. Implement [network segmentation](/glossary#network-segmentation) and restrict access to the TeamCity server and its agent polling protocol to only necessary internal systems.
*   **Monitoring for Exploit Activity**: Implement enhanced logging and monitoring for suspicious activity on TeamCity servers, particularly related to the agent polling protocol and any unusual process execution or network connections originating from the server. Security teams need to understand how to detect CVE-2026-63077 exploit activity by looking for anomalies indicative of RCE attempts or successful compromise.
*   **Discontinue Use**: If vendor mitigations are not immediately available or cannot be applied in a timely manner, organizations should consider temporarily discontinuing the use of the affected TeamCity product to prevent exploitation, as per CISA's guidance. Developing a comprehensive **mitigation for JetBrains TeamCity agent polling protocol vulnerability** involves a multi-layered approach, combining patching with network controls and vigilant monitoring.

**Related:** [CVE-2026-45659: SharePoint RCE Exploitation - Mitigation Guide](/blog/cve-2026-45659-sharepoint-rce-exploitation-mitigation-guide), [CVE-2026-45247: Magento Mirasvit Cache Warmer RCE Exploit Analysis](/blog/cve-2026-45247-magento-mirasvit-cache-warmer-rce-exploit-analysis)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2026-63077-jetbrains-teamcity-rce-via-deserialization