CVE-2026-63077

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-63077 9.8

JetBrains · TeamCity · Added 2026-08-05 · Published 2026-07-27

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityJetBrains TeamCity Deserialization of Untrusted Data Vulnerability

VendorJetBrains

ProductTeamCity

Date added2026-08-05

Due date2026-08-08

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-502

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.

NVD: In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-06 07:38 UTC

Wall time1.8s

Searches4

Component defaultyes

Sources https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/
https://github.com/nomi-sec/PoC-in-GitHub/blob/master/2026/CVE-2026-63077.json
https://nvd.nist.gov/vuln/detail/CVE-2026-63077
https://windowsforum.com/security-alerts.84/cve-2026-63077-update-teamcity-after-cisa-confirms-active-rce-exploitation.441721/
https://www.ionix.io/threat-center/cve-2026-63077/
https://www.rapid7.com/blog/post/etr-cve-2026-63077-critical-unauthenticated-remote-code-execution-in-jetbrains-teamcity/

QC notes

warn component_extraction: Component 'Agent polling protocol (TeamCity)' matches or contains product name 'TeamCity' — no specific component identified

Hunting hypothesis agent

Monitor for unauthenticated HTTP requests to TeamCity agent polling endpoints (/app/agents/protocols, XML-RPC endpoints) from untrusted IPs, and for unexpected TeamCity agent registration or process execution.

Research details

ComponentAgent polling protocol (TeamCity)

PreconditionsHTTP(S) network reachability to the TeamCity server agent polling endpoint — no authentication barrier; target must run a vulnerable version of TeamCity On-Premises agent

Public PoCno

Advisoryhttps://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0)

Tia coverage

First reported2026-07-31

First exploit report2026-08-06

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

critical-teamcity-vulnerability-cve-2026-63077-exploited-by-rans teamcity-rce-exploit-window-closes-today-rapid7-details-permissi

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.