CVE-2026-63077: Critical TeamCity Vulnerability Enables Remote Code Execution
On July 27, 2026, JetBrains published a critical security alert that shook the operations and security teams running continuous integration pipelines in production: an untrusted data deserialization vulnerability, catalogued as CVE-2026-63077, allows an unauthenticated remote attacker with HTTP or HTTPS access to a TeamCity On-Premises server to bypass authentication checks entirely and execute arbitrary operating system commands with the privileges of the server process itself. The flaw received a CVSS score of 9.8 out of 10 —the maximum possible severity— and barely nine days after its public disclosure, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog, confirming that malicious actors are already exploiting it in the wild. Help Net Security, The Hacker News, and SecurityWeek covered the issue in the hours following disclosure, while JetBrains' response team worked against the clock to deploy patched versions and publish a temporary mitigation plugin.
The problem, according to the technical analysis published by Rapid7 Labs, lies in the agent polling protocol that TeamCity uses to keep distributed runners synchronized with the central server. The server-side implementation creates a permissive XStream class allowlist —XStream being the XML serialization library that TeamCity uses to exchange messages between the server and remote agents— that adds TeamCity protocol classes without removing XStream's existing default permissions. That accumulation of permissions, designed to support the internal protocol, opens the door for any specially crafted XML request to take advantage of gadget chains that terminate in remote code execution, without the attacker needing to authenticate. The problem is structural, not configuration-related: the flaw resides in the server's own code, in the way the XStream allowlist is constructed, so any TeamCity On-Premises installation under that version is vulnerable by default, regardless of any hardening measures the operator has applied at the operating system, network, or perimeter authentication layer.
According to JetBrains' own description in their corporate blog, an attacker who can reach the TeamCity server over HTTP or HTTPS can exploit the flaw through the agent polling protocol, without needing credentials, and execute arbitrary operating system commands with the privileges of the TeamCity server process. The exposure is not limited to a single access path: any endpoint that uses the agent poller —including servers exposed directly to the Internet, those behind a load balancer or reverse proxy, and even those installed in internal networks with remote agents— is vulnerable. The attack surface is, in practice, any TeamCity On-Premises installation listening on the usual HTTP/HTTPS port. And here a nuance emerges that the Rapid7 team has underlined in their analysis: most organizations deploy TeamCity expecting it to be protected by a corporate VPN or web application firewall, but the agent poller needs persistent connectivity between distributed agents and the central server, so it is rarely fully blocked, which leaves the surface exposed in many cases even when the administration interface sits behind additional authentication layers.
What makes CVE-2026-63077 especially serious for DevSecOps teams is its systemic reach. TeamCity is not just a continuous integration server: it is the centerpiece that orchestrates build, test, deploy, and continuous delivery pipelines, and by design it accumulates credentials for signing artifacts, deploying to production, talking to container registries, source control systems, and cloud services. An attacker who obtains remote execution on the TeamCity server inherits all those privileges. The Hacker News, SecurityWeek, and Help Net Security agree that the risk is not limited to the affected server, but propagates downstream, potentially compromising the software supply chain of every application that depends on that pipeline. As Help Net Security warned, the TeamCity server stores deployment tokens, SSH keys, cloud credentials, and registry tokens that, once in the attacker's hands, can be used to insert backdoors into signed artifacts or rewrite source code in repositories that TeamCity has access to. The SolarWinds incident of 2020 left lessons about how a single intrusion into a CI/CD pipeline can spread to thousands of downstream organizations, and CVE-2026-63077 has all the technical characteristics to replicate that pattern: silent execution, persistence via legitimate access to privileged credentials, and the ability to inject malicious code into signed artifacts that victims consume with full cryptographic trust.
The historical context matters because TeamCity is no stranger to critical RCE vulnerabilities. In 2024, the project faced a series of similar flaws that also led CISA to take action, which makes TeamCity a recurring target for actors seeking to compromise software supply chains. That repetition, combined with the fact that corporate TeamCity instances are rarely on the radar of red teams (which tend to focus on the external perimeter), means the probability of detection by defenders during the initial exploitation phase is low. Analysts at Qualys ThreatPROTECT have compared CVE-2026-63077 with previous incidents that have used CI servers as a pivot point into internal networks, and the parallel is not coincidental.
The affected versions are all On-Premises TeamCity installations released up to the disclosure date —JetBrains' advisory does not exclude any branch—. TeamCity Cloud is not affected, since the company applies patches directly to its managed infrastructure. For On-Premises versions, JetBrains published the fixes in TeamCity 2026.1.3 (build 222742) and TeamCity 2025.11.7 (build 208264), and simultaneously released a security patch plugin that covers all versions from 2017.1 onwards, designed for organizations that, for compatibility reasons or change windows, cannot update the full server immediately. The company discourages applying the plugin as a permanent solution and strongly recommends planning a full upgrade to one of the patched versions as the fastest path to total mitigation. The availability of the plugin is relevant because many organizations maintain TeamCity instances on older versions for compatibility with third-party plugins, strict change policies, or simply operational inertia, and the plugin allows covering that gap while a major upgrade is planned.
The attack vector documented by Rapid7 and replicated in public proof-of-concept exploits makes the exposure window extremely short. Unlike vulnerabilities that require user interaction, phishing, or valid credentials, CVE-2026-63077 can be exploited by a single HTTP packet sent to a public endpoint of the server. This places any instance exposed to the Internet —directly or through a proxy— at immediate risk of compromise. Bleeping Computer, Qualys ThreatPROTECT, and SentinelOne's advisories have independently confirmed the ease with which the flaw is exploitable, and the fact that CISA added it to the KEV with a mitigation deadline of August 8 for U.S. federal agencies leaves little doubt about the operational severity of the incident. CISA itself, in its notification, described the vulnerability as one that allows an unauthenticated attacker to take complete control of the server with a single request, placing it in the highest category of operational risk.
The operational recommendation is immediate and three-layered, in line with what JetBrains, CISA, and independent analysts have published. First, identify the inventory: locate all TeamCity On-Premises instances under the organization's administration, without relying solely on the CMDB, because the proliferation of CI servers across different business units often leaves orphaned instances. In a typical enterprise environment, it is not uncommon to find three, five, or more TeamCity instances across different projects, many of them installed by development teams that no longer exist or that have moved to other projects without leaving a documented trail. Each of those instances is a potential entry vector. Second, apply the upgrade to 2026.1.3 or 2025.11.7 as soon as possible, or failing that deploy the security patch plugin published by JetBrains, remembering that the plugin is a temporary measure. Third, as a complementary mitigation while the upgrades are completed, restrict network access to the administration interface and the agent polling protocol endpoint to trusted networks only, ideally behind a VPN or zero-trust network access, and block public Internet access to TeamCity ports.
For teams that suspect or confirm prior exploitation, the indicators of compromise published by JetBrains and analysts include suspicious agent names with prefixes such as `scan*`, anomalous deserialization attempts in XStream logs (repeated `ConversionException` messages or unexpected payloads), and the presence of unexpected child processes of the TeamCity process. These indicators should be incorporated into the corporate SIEM detection rules and threat hunting pipelines with the highest priority. Additionally, if any compromise is confirmed, it is essential to rotate all credentials, SSH keys, deployment tokens, and secrets stored on the TeamCity server, since any element managed by the server should be considered exposed. Help Net Security was particularly explicit in pointing out that secret rotation is not optional: the only way to recover trust in a compromised CI/CD pipeline is to assume that every secret that passed through it at any time is public.
CVE-2026-63077 is, in summary, one of the most severe vulnerabilities disclosed in 2026 against DevSecOps infrastructure. It combines maximum technical severity (CVSS 9.8, no authentication, no user interaction) with a trivial exploitation vector (a single HTTP request), with a critical target asset (the server orchestrating production pipelines), and with confirmation of active exploitation in the wild. Teams that have not yet acted should treat it as an operational emergency and apply the mitigations recommended by JetBrains and CISA without delay. The window between disclosure and mass exploitation is typically days, and in this case there is already evidence that malicious actors are taking advantage of the flaw before victims manage to patch.
The operational lessons from CVE-2026-63077 go beyond the specific incident and touch the way organizations have been managing their DevSecOps surface. On one hand, the case reveals the structural fragility of trusting software delivery to CI servers whose inventory is not exhaustively known by security teams. On the other hand, it demonstrates that update cycles for critical products must be drastically shortened: when the gap between disclosure and exploitation is days, a change window of several weeks is equivalent to leaving the door open to the attacker. The analysts who have covered the response to the vulnerability agree that the next logical step for many organizations will be to audit not only the TeamCity inventory, but also the rest of the DevOps chain (repositories, runners, registries, signing services), because attackers who obtain RCE on a CI server rarely limit themselves to that first surface. Getting ahead —proactively searching for instances, patching before regulatory deadlines, monitoring the IoCs published by JetBrains and independent analysts— is the difference between a contained incident and a systemic compromise.
For teams that have already completed the initial mitigation and secret rotation, there is a second, less urgent but equally important phase: integrating the lesson into change management and threat modeling processes. The right question each organization should ask after CVE-2026-63077 is not only how to patch TeamCity, but how many other critical DevSecOps chain tools are exposed similarly without the organization knowing. Products such as runner agents, container signing services, artifact proxies, and internal registries are surfaces with the same criticality profile, and a serious DevSecOps vulnerability management program should treat them with the same rigor as the inventory of firewalls or web applications exposed to the Internet. CVE-2026-63077, in this sense, is not just a specific vulnerability that needs to be patched: it is a wake-up call about the general maturity of the operating model that each organization has built around its software delivery pipelines, and teams that respond only with an applied patch will be missing the opportunity to extract the real lesson. The detection and response side also deserves sustained attention. The IoCs published by JetBrains at the time of disclosure are the floor, not the ceiling, of what defenders should be looking for. Attackers who exploit CVE-2026-63077 have every incentive to erase their tracks, blending their activity with the normal background of XStream deserialization events that any TeamCity server produces routinely. Effective hunting, in this context, requires correlating multiple data sources: XStream logs for anomalies, OS process trees for unusual children of the TeamCity process, network logs for outbound connections to known malicious IPs, and application logs for the presence of new administrative accounts or new projects that the legitimate operators did not create. Security teams that have access to EDR or runtime telemetry on the TeamCity hosts have a significant advantage because they can pivot from the application-layer IoCs to the process-level activity that attackers inevitably leave behind. The cost of treating CVE-2026-63077 as a one-week sprint and then returning to business as usual is, in the context of an active supply-chain threat, an invitation to a future compromise. The cost of treating it as a structural problem that requires ongoing monitoring, hunting, and validation is the price of doing modern DevSecOps at a level fit for the threat landscape of 2026.