Bad Build: RCE Hits TeamCity

This week’s CVE of the Week is CVE-2026-63077, an unauthenticated remote code execution vulnerability in JetBrains TeamCity.

It is a deserialization issue in the popular CI/CD service, which leads to executing system commands in the operating system with recently published publicly available proof-of-concept exploit.

TeamCity is a build management and continuous integration/continuous delivery (CI/CD) server created by JetBrains. A vulnerability was disclosed on 27th July by the creators, revealing information about the case, then a proof-of-concept (PoC) was published by Rapid7 at 7th August.

The vulnerability, with a CVSS-score 9.8, has been identified only in TeamCity On-Premises. If the exploitation was successful from the attacker, it may let them bypass authentication via HTTP(S) protocol and execute arbitrary system commands.

Authentication bypass is achieved by the agent polling protocol when a deserialization happens. The exploit works with an XStream gadget chain that writes to the disk a polyglot SQL/JSP file and remote code execution is achieved with a GET request over HTTP(S) sent to the file on the disk.

JetBrains published mitigations on 7th August. Mitigations were published in version: 2025.11.7 or 2026.1.3, every version before these are affected.

Organizations using the vulnerable versions should update to the new versions. If something hooks the updates, then there are plugins for the affected versions. The plugin automatically downloads for TeamCity 2024.03 and newer versions. For TeamCity 2017.1 to 2018.1 it’s a manual work with server restart. Starting from TeamCity 2018.2 you can enable the plugin without restarting the server.

For more information about the vulnerability, consult the official advisories or other relevant articles:
https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/
https://blog.jetbrains.com/teamcity/2026/08/cve-2026-63077-update/
https://thehackernews.com/2026/08/cisa-flags-teamcity-cve-2026-63077-rce.html

Would you like to be secured by a professional SOC Team? Check out our managed services: Managed Security | White Hat IT Security