CVE-2026-63077: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2026-63077 is a critical unauthenticated remote code execution (RCE) vulnerability in JetBrains TeamCity, exploitable via the agent polling protocol without any authentication. It affects TeamCity versions before 2026.1.3 and before 2025.11.7. The vulnerability was disclosed on July 27, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, JetBrains Blog).

The root cause is improper deserialization of untrusted data (CWE-502) within TeamCity's agent polling protocol, which is used by build agents to communicate with the TeamCity server. An unauthenticated remote attacker can send a crafted payload to this protocol endpoint, triggering unsafe deserialization that results in arbitrary code execution on the server. No privileges or user interaction are required, and the attack complexity is low, making it trivially automatable. The vulnerability is mapped to CAPEC-586 (Object Injection) (GitHub Advisory, JetBrains Blog).

Successful exploitation grants an unauthenticated attacker full remote code execution on the TeamCity server, resulting in complete compromise of confidentiality, integrity, and availability. Because TeamCity is a CI/CD platform, a compromised server could expose source code, build secrets, deployment credentials, and pipeline configurations — creating significant supply chain risk. Attackers could leverage access for lateral movement into connected infrastructure, inject malicious code into build artifacts, or disrupt development operations entirely (GitHub Advisory, Security Affairs, Undercode News).

1. Reconnaissance: Identify internet-facing JetBrains TeamCity server instances using tools like Shodan or Censys, filtering for versions prior to 2026.1.3 or 2025.11.7. TeamCity typically exposes its web interface on port 8111 (HTTP) or 443 (HTTPS).
2. Identify agent polling endpoint: Locate the TeamCity agent polling protocol endpoint, which build agents use to communicate with the server. This endpoint is accessible without authentication on vulnerable versions.
3. Craft malicious deserialization payload: Construct a serialized Java object payload (e.g., using tools like ysoserial) targeting a known gadget chain compatible with TeamCity's classpath, designed to execute arbitrary OS commands upon deserialization.
4. Deliver payload: Send the crafted payload to the agent polling protocol endpoint over the network. No credentials or prior access are required.
5. Achieve code execution: The server deserializes the malicious object, triggering the gadget chain and executing the attacker's commands as the TeamCity service account, enabling reverse shell establishment, credential harvesting, or build pipeline manipulation (GitHub Advisory, JetBrains Blog).

• Network: Unexpected or anomalous connections to the TeamCity agent polling protocol port from non-agent IP addresses; outbound connections from the TeamCity server to unknown external IPs (potential reverse shell or C2 traffic).
• Logs: TeamCity server logs showing deserialization errors or unexpected exceptions in agent communication handlers; access log entries with unusual request patterns to agent polling endpoints from non-registered agent IPs.
• Process: Unusual child processes spawned by the TeamCity Java process (e.g., cmd.exe, powershell.exe, /bin/bash, curl, wget); unexpected network connections initiated by the TeamCity service account.
• File System: New or modified files in the TeamCity installation directory, temp directories, or web root; presence of web shells, reverse shell scripts, or unauthorized executables created by the TeamCity service account.
• Registry/Scheduled Tasks: New scheduled tasks or cron jobs created under the TeamCity service account context (GitHub Advisory, Help Net Security).

JetBrains has released patched versions: TeamCity 2026.1.3 and TeamCity 2025.11.7. All users should upgrade to one of these versions immediately. As a temporary workaround if immediate patching is not possible, implement network segmentation to restrict access to the agent polling protocol endpoint to only trusted build agent IP addresses. JetBrains Cloud-hosted TeamCity instances are not affected (JetBrains Blog, GitHub Advisory).

JetBrains published a dedicated blog post and security advisory on July 27, 2026, urging customers to patch immediately (JetBrains Blog). The vulnerability received broad coverage from security media including The Hacker News, Help Net Security, Security Affairs, GBHackers, and Cyberpress, with many outlets highlighting the supply chain risk posed by a compromised CI/CD server (The Hacker News, Help Net Security, Security Affairs). Community discussion on Reddit and Mastodon reflected urgency given TeamCity's history of high-profile RCE vulnerabilities being rapidly weaponized. Security researchers on social media noted the vulnerability's similarity to prior TeamCity deserialization issues and emphasized the importance of prompt patching.