JetBrains TeamCity Deserialization of Untrusted Data Vulnerability (CVE-2026-63077)

What is affected, what to do

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update JetBrains TeamCity to version 2026.1.3, JetBrains TeamCity to version 2025.11.7. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• JetBrains TeamCity lt 2026.1..2026.1.3
• JetBrains TeamCity lt *..2025.11.7

Fixed in

• JetBrains TeamCity 2026.1.3
• JetBrains TeamCity 2025.11.7

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Find and cut exposure now: Inventory every TeamCity server (default web port 8111, or 443 behind a reverse proxy). Immediately block internet access or restrict it to known build-agent source IPs. The attack vector is the agent polling protocol, so any publicly reachable server should be treated as at imminent risk.
   • Apply the vendor fix: Per the CVE description, versions before 2026.1.3 and 2025.11.7 are affected. Upgrade to 2026.1.3 (2026.1 branch) or 2025.11.7 (2025.11 branch) or later. The affected-product data is ambiguous, so confirm the exact fixed build in JetBrains' security bulletin. Take a backup and a forensic snapshot of the server before upgrading.
   • Hunt for compromise before restoring trust: CISA flags known ransomware use. Check for newly created admin accounts, unknown authorised build agents, modified build configurations and new access tokens. If anything looks off, isolate the host and open an incident, and assess NIS2 reporting obligations.
   • Rotate secrets: On any sign of compromise, and as a precaution for internet-exposed instances, replace every secret held by TeamCity: VCS credentials, SSH deploy keys, cloud and registry tokens, code-signing certificates, password-type parameters and personal access tokens.
   • Protect the supply chain: Treat artefacts built since the earliest possible exposure date as untrusted. Hold releases from that window until the integrity of the build environment is confirmed.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place the TeamCity server in a dedicated CI/CD segment. Allow inbound traffic only from build agents (IP allowlist) and from admins via VPN or a jump host. Restrict server egress to VCS, artefact repositories and update sources (default deny) to frustrate reverse shells and exfiltration.
   • Reverse proxy/WAF: Forward agent communication paths only for known agent IPs and return 403 to everyone else. Block requests whose body carries Java serialisation markers (magic bytes AC ED 00 05, or Base64 rO0AB), and log unusually large or binary POST bodies sent to agent endpoints.
   • IPS: Enable Suricata/Snort rules that detect Java deserialisation payloads (rO0AB or |AC ED 00 05| in HTTP bodies to the TeamCity port). Deploy CVE-2026-63077-specific signatures as soon as your IPS vendor ships them.
   • Endpoint hardening: Run the TeamCity service under an unprivileged service account, never as SYSTEM or root. Use EDR or AppLocker/WDAC to block, or at minimum alert on, the server's Java process spawning shells (cmd.exe, powershell.exe, bash, sh). Do not run builds on the server node itself.
   • IAM/least privilege: Minimise the number of TeamCity system administrators and enforce SSO with MFA for web login. Give builds only short-lived, narrowly scoped credentials; no standing cloud-admin keys.
   • Configuration: Disable automatic authorisation of new agents. Approve each agent manually and remove unused agent pools.
3. 03

   Runbook step 3

   Detection rules

   • Process ancestry (Sysmon EID 1 / Windows EID 4688 / EDR): Alert when the TeamCity server Java process spawns shells or LOLBins. Example KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "java.exe" and InitiatingProcessCommandLine has "teamcity" and FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","curl.exe","bitsadmin.exe"). On Linux, use auditd execve records with parent java and exe in /bin/sh, /bin/bash, curl or wget.
   • Application logs: In teamcity-server.log, teamcity-auth.log and the audit log, look for new users or "System administrator" role grants, new access tokens, plugin uploads, and agent registrations from unknown hosts. Also review deserialisation errors or ClassNotFoundException entries around agent requests.
   • Web/proxy logs: Flag POSTs to agent endpoints from IPs that are not in the agent inventory. Example SPL: index=proxy dest_port IN (8111,443) uri_path="*agent*" NOT src_ip IN (agent_allowlist) | stats count by src_ip, uri_path.
   • Network telemetry (Zeek/Suricata): Watch for new outbound connections from the TeamCity server to unfamiliar destinations, such as tunnelling or paste services, or binary downloads shortly after inbound agent traffic. Also watch for Java serialisation signatures in http.log/files.log.
   • File system (Sysmon EID 11 / auditd): Look for new JAR, script or EXE files in TeamCity plugin, temp or webapp directories, and for new scheduled tasks, services or cron entries on the server.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Source: BSI WID Portal, BSI CSAF, NVD (NIST), pwn.watch, CISA KEV Catalog, cvelistv5, CVE.org (MITRE)

Vendors and products

• JetBrains JetBrains TeamCity

Weakness classes (CWE)

• CWE-502Deserialization of Untrusted Data

  Base

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  Entry at MITRE CWE-502

References & sources

• jetbrains.comprivacy-security/issues-fixedVendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077government-resource, US government resource
• pwn.watchpwn.watch: JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerabilitypwn-watch
• blog.jetbrains.comJetBrains TeamCity — CVE-2026-63077pwn-watch
• NVD (NIST)NVD: CVE-2026-63077pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 06.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-63077","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-05T17:46:04.215479Z"}	{"id":"CVE-2026-63077","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-27T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 05.08.2026Initial analysis by NVDNVD

   Newly listed as affected:

   • JetBrains TeamCity (before 2025.11.7; 2026.1 – before 2026.1.3)

   New references:

   • https://www.jetbrains.com/privacy-security/issues-fixed/
   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	added	—	OR *cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:* versions up to (excluding) 2025.11.7 *cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:* versions from (including) 2026.1 up to (excluding) 2026.1.3
   Reference type	added	—	JetBrains s.r.o.: https://www.jetbrains.com/privacy-security/issues-fixed/ Types: Vendor Advisory
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077 Types: US Government Resource

   Source identifier: nvd@nist.gov

3. 05.08.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-08-05
   Due Date	added	—	2026-08-05
   Required Action	added	—	2026-08-05
   Vulnerability Name	added	—	2026-08-05

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

4. 05.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077
   SSVC assessment	changed	{"id":"CVE-2026-63077","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-27T00:00:00+00:00"}	{"id":"CVE-2026-63077","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-05T17:46:04.215479Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 27.07.2026Receivedjetbrains.com

   CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

   Weakness type: CWE-502

   Description added or changed

   New references:

   • https://www.jetbrains.com/privacy-security/issues-fixed/
   Show 5 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Affected versions (publisher)	added	—	TeamCity
   Description	added	—	In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
   CVSS	added	—	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
   Weakness type (CWE)	added	—	CWE-502
   Reference	added	—	https://www.jetbrains.com/privacy-security/issues-fixed/

   Source identifier: cve@jetbrains.com

One NVD translation into another language is hidden.

Linked advisories

• CISA Adds Five CVEs to Known Exploited Vulnerabilities CatalogSANS NewsBites07.08.2026