CVE-2026-63077
published 2026-07-27CVE-2026-63077: In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-08-08
Exploited in the wild
EPSS
87.71%
99.8th percentile
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jetbrains | teamcity | < 2026.1.3, 2025.11.7 | 2026.1.3, 2025.11.7 |
| jetbrains | teamcity | < 2025.11.7 | 2025.11.7 |
| jetbrains | teamcity | >= 2026.1 < 2026.1.3 | 2026.1.3 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
JetBrains TeamCity prior 2026.1.3/2025.11.7 Agent Polling Protocol code injection (Nessus ID 330833)
vuldb·2026-08-05·CVSS 9.8
CVE-2026-63077 [CRITICAL] JetBrains TeamCity prior 2026.1.3/2025.11.7 Agent Polling Protocol code injection (Nessus ID 330833)
A vulnerability classified as critical was found in JetBrains TeamCity. Affected by this issue is some unknown functionality of the component Agent Polling Protocol. Such manipulation leads to code injection.
This vulnerability is documented as CVE-2026-63077. The attack can be executed remotely. Additionally, an exploit exists.
Upgrading the affected component is advised.
GHSA
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
ghsa_unreviewed·2026-07-27
CVE-2026-63077 [CRITICAL] CWE-502 In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
VulnCheck
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
vulncheck·2026·CVSS 9.8
CVE-2026-63077 [CRITICAL] CWE-502 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
Affected: JetBrains TeamCity
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Exploitation References: http
CISA
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
cisa·2026-08-05·CVSS 9.8
CVE-2026-63077 [CRITICAL] CWE-502 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
Vulnerability: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
Affected: JetBrains TeamCity
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https://
No detection rules found.
Nuclei
JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution
nuclei·CVSS 9.8
CVE-2026-63077 [CRITICAL] JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution
JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution
JetBrains TeamCity < 2026.1.3, 2025.11.7 contains a remote code execution caused by unauthenticated access via the agent polling protocol, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.
Template:
id: CVE-2026-63077
info:
name: JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution
author: 0x_Akoko,pdteam
severity: critical
description: |
JetBrains TeamCity < 2026.1.3, 2025.11.7 contains a remote code execution caused by unauthenticated access via the agent polling protocol, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.
impact: |
Unauthenticated attackers can execute arbitrary code remotely, potentiall
Rapid7
Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
blogs_rapid7·2026-08-07·CVSS 9.8
CVE-2026-63077 [CRITICAL] Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
## Overview
On July 27, 2026, JetBrains published a security advisory for CVE-2026-63077 , a critical unsafe deserialization vulnerability affecting JetBrains TeamCity . An attacker who can reach a TeamCity server over HTTP or HTTPS can exploit the agent polling protocol without credentials and execute operating system commands with the privileges of the TeamCity server process.
JetBrains reported no known active exploitation when it disclosed the vulnerability. However, on August 5, 2026, CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog, confirming exploitation in the wild.
Our analysis finds that a vulnerable TeamCity server creates a permissive XStream allowlist. This allowlist is intended to restrict which Java classes can be deserialized when servicing
Hackernews
CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild
blogs_hackernews·2026-08-06·CVSS 9.8
CVE-2026-63077 [CRITICAL] CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild
A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild , according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
The vulnerability in question is CVE-2026-63077 (CVSS score: 9.8), a case of deserialization of untrusted data that could allow an unauthenticated attacker with access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.
"JetBrains TeamCit
Checkpoint
3rd August – Threat Intelligence Report
blogs_checkpoint·2026-08-03
CVE-2026-59726 3rd August – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 3rd August – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 27th July, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Minnesota IT Services has confirmed coordinated cyberattacks affecting more than 30 community water utilities across the state. The incidents briefly disrupted a treatment plant in Braham and affected industrial control systems. Officials reported that drinking water safety was not affected. While the attack was not officially attributed, federa
Hackernews
⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
blogs_hackernews·2026-08-03
CVE-2026-42897 ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
This week kept coming back to permission. A model crossed a boundary. A wallet trusted bad randomness. Webmail kept an intruder around. Public systems, package feeds, hotel networks, and login flows all gave away more than intended.
Some of it was clever. Most of it was just access left lying around: old bugs, exposed gear, poisoned dependencies, weak defaults, and tooling that moved from forum chatter to real targets.
The full weekly recap report follows.
## ⚡ Threat of the Week
Anthropic Disclosed its Models Targeted 3 O
Rapid7
CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity
blogs_rapid7·2026-07-29·CVSS 9.8
CVE-2026-63077 [CRITICAL] CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity
## Overview
On July 27, 2026, JetBrains published a security advisory for CVE-2026-63077 , a critical unauthenticated vulnerability affecting all versions of TeamCity On-Premises. The issue is classified as deserialization of untrusted data and has a CVSS score of 9.8 . An unauthenticated remote attacker with HTTP(S) access to a TeamCity server can exploit the agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.
In the blog post that JetBrains shared in tandem with CVE publication, they stated that attackers who exploit the vulnerability can read stored credentials and compromise CI/CD pipeline integrity. The impact of successful exploitation depends on the operating system privileges gr
Hackernews
Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
blogs_hackernews·2026-07-28·CVSS 9.8
CVE-2026-63077 [CRITICAL] Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution.
The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already been updated. JetBrains has credited Antoni Tremblay with discovering and reporting the flaw on July 10, 2026.
"If exploited, this flaw may enable an unaut
2026-07-27
Published
2026-08-05
Added to CISA KEV
Exploited in the wild