Full research report
CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild
Executive assessment
CVE-2026-63077 is a critical unauthenticated remote code execution flaw in JetBrains TeamCity On-Premises arising from insecure deserialisation in the agent polling protocol, exploitable by any attacker with network access to the server and requiring no credentials or user interaction. JetBrains disclosed and patched the vulnerability on 27 July 2026 with no initial evidence of exploitation; however, CISA's addition to the Known Exploited Vulnerabilities catalogue on 5 August 2026 — approximately one week after public disclosure — confirms that threat actors moved quickly to weaponise the flaw, consistent with the exploitation pattern seen against prior critical TeamCity vulnerabilities such as CVE-2023-42793. The threat is particularly acute for software supply chain security, as TeamCity servers hold build credentials, source artefacts, and research process configurations that can enable downstream compromise of software products and their consumers. No threat actor has been attributed, no public proof-of-concept has been identified, and no indicators of compromise have been released, leaving defenders with limited visibility into active attacks and making telemetry-based hunting the primary detection option. Organisations should treat unpatched internet-accessible TeamCity instances as a critical emergency and prioritise patching ahead of the FCEB deadline of 8 August 2026.
What happened
On 27 July 2026 JetBrains published an advisory for CVE-2026-63077, a CVSS 9.8 deserialization-of-untrusted-data flaw affecting all on-premises versions of TeamCity that permits unauthenticated remote code execution via the agent polling protocol. Fixed versions 2025.11.7 and 2026.1.3, plus a security patch plugin for instances running version 2017.1 and later, were released simultaneously with the disclosure. Approximately one week after publication, on 5 August 2026, CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue, confirming active exploitation in the wild. FCEB agencies face a mandatory patch deadline of 8 August 2026.
Affected scope
All JetBrains TeamCity On-Premises versions prior to 2025.11.7 (2025.11.x branch) and prior to 2026.1.3 (2026.1.x branch). TeamCity Cloud is not affected. Organisations at elevated risk include software development teams, DevOps operations, and any enterprise running internet-accessible TeamCity infrastructure, particularly those where build servers hold privileged credentials or feed into downstream deployment pipelines.
Technical assessment
The flaw (CWE-502) resides in the agent polling protocol endpoint, which processes serialised data from connecting agents without adequate authentication validation. An unauthenticated attacker with HTTP or HTTPS network access can submit a crafted serialised payload to this endpoint, bypassing authentication checks and causing the server to execute arbitrary operating system commands under the privileges of the TeamCity process. Successful exploitation may expose stored credentials, build configurations, source artefacts, and environment secrets, and could enable tampering with build pipelines, representing a meaningful software supply chain risk.
Recommended defensive actions
- Patch immediately to TeamCity On-Premises version 2025.11.7 or 2026.1.3; this is the only complete remediation.
- Apply the JetBrains security patch plugin to any instance running version 2017.1 or later that cannot be upgraded immediately; restart the server for versions 2017.1 through 2018.1.
- Restrict network access to TeamCity servers at the firewall or load-balancer level so that the agent polling protocol endpoint is not reachable from untrusted networks.
- Audit TeamCity server process logs and agent polling activity for anomalous command execution or unexpected outbound connections since 27 July 2026.
- Rotate all credentials, API tokens, and secrets stored in or accessible via TeamCity on any instance that was unpatched and internet-accessible during the exposure window.
Uncertainties and evidence gaps
- No public details of the attacks in progress have been released: threat actor identity, targeted organisations or sectors, post-exploitation objectives, and scale of exploitation all remain unknown.
- No public proof-of-concept exploit code has been identified; it is unclear whether exploitation relies on independently developed private tooling or a circulated but non-public PoC.
- JetBrains had not updated its own advisory to confirm active exploitation as of the time of reporting; CISA's KEV addition remains the sole authoritative public confirmation currently available.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Confirmed active exploitation in the wild; CISA added CVE-2026-63077 to the Known Exploited Vulnerabilities catalogue on 5 August 2026, approximately one week after initial public disclosure. No threat actor identity, specific victims, or indicators of compromise have been publicly reported.
Research began from the CISA KEV addition of CVE-2026-63077 on 5 August 2026 as the principal exploitation signal and worked backward to the JetBrains advisory of 27 July 2026 as the primary technical source. The NVD record independently confirmed CVSS scoring, CWE classification, and KEV inclusion. Rapid7, Help Net Security, and SecurityWeek provided independent corroboration of both the initial disclosure and the onset of exploitation. Targeted searches for public proof-of-concept code and threat actor attribution returned no confirmed results, leaving exploitation mechanics and actor identity as material unknowns.
- What are the basic technical details and fix status of CVE-2026-63077?Searched for CVE-2026-63077 JetBrains TeamCity RCE deserialization 2026
Multiple secondary sources confirm a CVSS 9.8 deserialization flaw in the agent polling protocol, fixed in versions 2025.11.7 and 2026.1.3, with a security patch plugin available for older instances.
why Established scope and fix availability before seeking primary sources for verification.
- Does the JetBrains vendor advisory confirm the vulnerability mechanism, affected scope, and exploitation status?Fetched the JetBrains Blog advisory directlyblog.jetbrains.com ↗
JetBrains confirmed the flaw on 27 July 2026; all TeamCity On-Premises versions are affected; TeamCity Cloud is unaffected; at time of publication JetBrains reported no known active exploitation.
why Primary vendor source establishes the authoritative baseline for scope and the pre-exploitation disclosure status, against which subsequent exploitation confirmation can be measured.
- Does the NVD record independently confirm CVSS scoring, CWE classification, and CISA KEV inclusion?Fetched the NVD vulnerability detail pagenvd.nist.gov ↗
NVD confirms CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-502, publication date 27 July 2026, and references the CISA KEV catalogue for this CVE.
why Independent authoritative record corroborates vendor details and formally links the CVE to the CISA KEV catalogue, supporting high-confidence assessment.
- What does independent security research say about the attack vector and PoC availability?Fetched Rapid7 early threat research post for CVE-2026-63077rapid7.com ↗
Rapid7 corroborates the agent polling protocol as the attack surface and the affected version range; no PoC is referenced; recommends urgent patching and network access restriction.
why Independent technical corroboration from a credible security firm strengthens confidence in the vulnerability description; explicit absence of any PoC reference is a relevant signal for defender risk assessment.
- Is there any detail on who is exploiting this, how, and against what targets?Fetched SecurityWeek article reporting on active exploitationsecurityweek.com ↗
SecurityWeek confirms CISA added the CVE to the KEV catalogue approximately one week after disclosure; no actor attribution, victim organisations, IoCs, or technical exploitation details are publicly available.
why Corroborates the exploitation timeline and CISA KEV addition while making clear that defender visibility into active attacks is severely limited.
- Is any public proof-of-concept or exploit code in circulation?Searched for CVE-2026-63077 TeamCity proof of concept exploit code GitHub 2026
No public PoC or exploit code was identified across search results; sources note exploitation is confirmed but no technical exploitation artefacts are publicly available.
why Absence of public PoC indicates that active exploitation likely relies on privately developed tooling, making detection and emulation harder for defenders and lowering the immediate threat to unpatched instances only accessible internally.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 6 registered sources supplied useful evidence (3 primary, 2 corroborating, 1 contextual and 0 PoC/exploit references). 55 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1661 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok14 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| Rapid7news | ok empty0 records | Corroborating1 matched items | Supplied independent analysis opened and verified during focused research. |
| FIRST EPSSepss | ok | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5321 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok675 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1007 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 3 opened outside the registered collection
Vulnerability & exploitation2
Vendor & gov advisories2
Primary vendor advisory confirming fix versions, security patch plugin availability, and TeamCity Cloud being unaffected
Authoritative NVD record confirming CVSS 9.8, CWE-502, affected CPE ranges, and CISA KEV inclusion
Analysis & research3
Independent technical analysis corroborating attack vector and affected versions; no public PoC cited
Independent reporting at initial disclosure; names security researcher Antoni Tremblay as discoverer via private disclosure
Corroborates CISA KEV addition and exploitation onset; notes no public exploitation details, actor attribution, or IoCs are available