TL;DR

CVE-2026-63077 is a CVSS 9.8 unauthenticated remote code execution on JetBrains TeamCity On-Premises, exploitable via deserialization of untrusted data in the agent polling protocol. CISA added it to KEV on August 5 with a due date of today, August 8. All TeamCity On-Premises versions are affected. A security patch plugin is available for versions back to 2017.1.

The Vulnerability

JetBrains published the advisory on July 31, alongside a security advisory from the NVD:

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class: CWE-502 — Deserialization of Untrusted Data.

This isn’t a subtle edge-case deserialization. The agent polling protocol accepts serialized objects from build agents, and an unauthenticated attacker can send a crafted payload that instantiates an arbitrary class with controlled input. That’s the textbook definition of unauthenticated RCE.

Why the CVSS 9.8 Makes Sense

Metric Value
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Three things that matter:

  1. No authentication. Attackers don’t need a TeamCity account. The agent polling protocol endpoint is reachable without a login.
  2. No user interaction. No clicking, no waiting for a build to start. Send the payload and execute.
  3. Full impact. This isn’t just reading data — it’s write, delete, exec. A compromised CI server is a jump box into the build network.

Affected Versions

From the JetBrains advisory:

  • All TeamCity On-Premises versions are affected (2017.1 through the current release)
  • TeamCity Cloud is not affected — JetBrains has already applied mitigations server-side

Fixed versions:

  • 2026.1.3 (current stable)
  • 2025.11.7 (previous LTS)

Workaround for older versions:

JetBrains released a security patch plugin for TeamCity 2017.1+. This is the important one for organizations that can’t upgrade immediately. For TeamCity 2024.03 and newer, the plugin is auto-downloaded and pending installation notifications appear in the admin UI. For 2017.1–2018.1, a server restart is required after installation.

The Attack Surface

TeamCity’s agent polling protocol is how build agents check in with the server for pending jobs. This protocol is typically exposed internally (agents are behind the corporate network or VPN), but many organizations expose it to the internet for remote/hybrid agents.

If your CI agents are internet-facing, the exploit is trivial. If they’re internal-only, it still matters because:

  • Compromised build agents run with the credentials of the build user
  • Build steps commonly include docker, kubectl, and database connections
  • Artifacts from builds are often deployed directly to production

What To Do

  1. Check if you’re on-prem or cloud. Cloud customers are safe for now.
  2. If on-prem, check your version. curl -u admin:password https://teamcity.yourdomain.com/httpAuth/app/rest/server | python3 -m json.tool — the version field tells you.
  3. Upgrade to 2025.11.7 or 2026.1.3 if possible. That’s the cleanest fix.
  4. If you can’t upgrade, install the security patch plugin. For 2024.03+, it should already be showing as pending. For older versions, download from the plugin repository and restart the server.
  5. Verify the fix. After patching, try sending a deserialized payload to the agent polling endpoint:
curl -s https://teamcity.yourdomain.com/app/rest/agents/poll -o /dev/null -w "%{http_code}"
# If the agent polling endpoint still accepts deserialized input without validation, the plugin isn't installed correctly.

The Bigger Pattern

This is the fourth deserialization RCE in a CI/CD tool in as many weeks. July had the Appsmith Caddy admin API bypass, and now TeamCity’s agent protocol. The pattern is consistent:

  • CI/CD tools serialize build metadata, build parameters, and agent telemetry
  • Deserialization endpoints are often overlooked in security reviews because they’re “internal”
  • A deserialization RCE on a CI server is worth more than one on a web app — you get credentials, SSH keys, and deploy access all at once

If you haven’t audited your CI/CD deserialization endpoints this quarter, do it now.

References