Deserialization flaw in JetBrains TeamCity (CVE-2026-63077) — unauthenticated remote code execution through the agent channel

1Deserialization as an attack surface

Programs convert objects — bundles of data — into a form that can be sent over a file or a connection, and the receiving side converts them back. That converting back is deserialization. If the received data is restored without validation, an attacker can send data crafted so that processing runs during restoration, which can lead to arbitrary code execution. CWE-502 names this class.

2The agent polling channel as the entry point

The entry point named here is the agent polling protocol. TeamCity runs with multiple agents that execute builds and periodically poll a central server. That channel exists for internal components to talk to each other and is separate from the user login screen. When a path that can be reached without authentication remains open, hardening the login side can be bypassed entirely — which is the shape of this case.

3What a build platform means

TeamCity automates the process that turns source code into distributable artifacts. Taking control of it opens the possibility of altering the artifacts themselves, so the impact does not stop at the organization running it but can extend to whoever receives what it ships. This site also covers a separate TeamCity vulnerability (CVE-2024-27199), and the record shows development infrastructure being targeted repeatedly.

The three days between KEV addition and the due date can be read as reflecting that weight.

4A route that hardening the interface does not close

TeamCity runs with several build agents polling a central server at intervals. What this record names as the entrance is that internal route.

Deserialization is the class where restoring received data without validating it allows data that runs code during restoration to be sent in. TeamCity automates the process of turning source code into artifacts, so taking it opens the possibility of altering the artifacts themselves. A three-day window from listing to remediation reads as reflecting that weight.