ZeroDayAlert

CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.

JetBrains TeamCity Added to KEV 2026-08-05 Federal due 2026-08-08 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

JetBrains TeamCity is affected by a deserialization vulnerability in its agent polling protocol. The flaw permits unauthenticated remote code execution, meaning an attacker does not need valid credentials to exploit it. The record does not specify which versions of TeamCity are vulnerable, nor does it detail whether on-premises, cloud-hosted, or both deployment models are in scope.

How to check whether this touches you

  • Search your infrastructure inventory for any running instance of JetBrains TeamCity, including agent nodes and server components.
  • Confirm whether your TeamCity server is reachable from the internet or from untrusted networks; the agent polling protocol must be accessible for exploitation.
  • Query your TeamCity instance version through the web UI (typically visible in Settings → About) or by inspecting buildserver.properties on the server filesystem; note that backported security fixes may exist in patches you cannot detect from version strings alone.
  • Check your network logs and firewall rules for inbound connections to the TeamCity agent communication ports (usually 9090 by default, but verify your configuration).

What to do

  1. Review JetBrains' official security advisory and vendor patch guidance immediately; CISA's remediation due date is 2026-08-08.
  2. If you cannot patch within the deadline, restrict network access to the TeamCity agent polling protocol to trusted internal networks only, using firewall rules or network segmentation.
  3. Enable and review audit logging for the agent polling protocol to detect any connection attempts from unexpected sources.
  4. If your deployment is a cloud-hosted service, consult the vendor's guidance on mitigations or service suspension per BOD 26-04, and escalate to your information security team if no mitigation path is available.
  5. If you run on-premises TeamCity, prioritise patching the server and all connected agents; test patches in a non-production environment first.
  6. Notify your security operations centre and incident response team of the vulnerability's presence in your environment, even if not yet exploited.

If you find you were exposed

Exploitation of deserialization flaws typically occurs before public disclosure; you should assume any TeamCity instance exposed to untrusted networks during the vulnerability window may have been compromised. Retrieve and preserve all available logs from the affected server and agents, focusing on authentication attempts, process execution, and network connections during the exposure period. If your log retention is shorter than the time between first deployment and today, document that gap. Engage your incident response team to conduct forensic triage on the affected systems, looking for unauthorised process execution, credential theft, and lateral movement indicators.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-63077 is being exploited. It cannot tell you whether TeamCity is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →