Deserialization flaw in JetBrains TeamCity (CVE-2026-63077) — unauthenticated remote code execution through the agent channel
The build automation platform JetBrains TeamCity contains a deserialization-of-untrusted-data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. CISA added it to KEV on August 5, 2026 with a due date of August 8.
Key facts
- CVE IDCVE-2026-63077
- Affected (vendor / product)JetBrains TeamCity
- CWECWE-502
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2026-08-08 (U.S. federal civilian agencies, BOD 22-01)
- Required action (CISA)Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Key points
- Affected: JetBrains TeamCity, a build automation platform. CWE-502 (deserialization of untrusted data).
- Could allow unauthenticated remote code execution via the agent polling protocol.
- The entry point is separate from the user login screen, so hardening the login side can be bypassed.
- Control of a build platform opens the possibility of altering artifacts, extending impact to recipients.
- Added to KEV 2026-08-05 with a due date of 2026-08-08 — three days. This site also covers CVE-2024-27199 in the same product.
- The entrance is the agent polling route, which hardening the user-facing interface does not close.
1JetBrains TeamCity deserialization
JetBrains TeamCity, a build automation platform, contains a deserialization of untrusted data vulnerability (CVE-2026-63077, CWE-502) that could allow unauthenticated remote code execution via the agent polling protocol. CISA added it to KEV on 2026-08-05 with a due date of 2026-08-08, three days later. Because the entry point is a channel separate from the user login screen, hardening the interface alone may not stop it.
2Deserialization as an attack surface
Programs convert objects — bundles of data — into a form that can be sent over a file or a connection, and the receiving side converts them back. That converting back is deserialization. If the received data is restored without validation, an attacker can send data crafted so that processing runs during restoration, which can lead to arbitrary code execution. CWE-502 names this class.
3The agent polling channel as the entry point
The entry point named here is the agent polling protocol. TeamCity runs with multiple agents that execute builds and periodically poll a central server. That channel exists for internal components to talk to each other and is separate from the user login screen. When a path that can be reached without authentication remains open, hardening the login side can be bypassed entirely — which is the shape of this case.
4What a build platform means
TeamCity automates the process that turns source code into distributable artifacts. Taking control of it opens the possibility of altering the artifacts themselves, so the impact does not stop at the organization running it but can extend to whoever receives what it ships. This site also covers a separate TeamCity vulnerability (CVE-2024-27199), and the record shows development infrastructure being targeted repeatedly.
The three days between KEV addition and the due date can be read as reflecting that weight.
5A route that hardening the interface does not close
TeamCity runs with several build agents polling a central server at intervals. What this record names as the entrance is that internal route.
Deserialization is the class where restoring received data without validating it allows data that runs code during restoration to be sent in. TeamCity automates the process of turning source code into artifacts, so taking it opens the possibility of altering the artifacts themselves. A three-day window from listing to remediation reads as reflecting that weight.
Why it matters
CI/CD infrastructure produces the artifacts that go to customers, which makes a compromise different in kind from one in an ordinary business system. Beyond authentication on the management interface, reviewing how far internal channels such as agent traffic can be reached, and having signing and verification for build outputs, are the operative points.
FAQ
What is a deserialization vulnerability?
Why is it reachable without authentication?
Why is compromising a build platform serious?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).