CVE-2026-63077 Exploited in the wild

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Risk score: 94/100
CVSS: 9.8 v3.1
Published: 27 Jul 2026
Added to CISA's exploited list: 5 Aug 2026

Open in the live forecast Today's forecast

What to know

What it is: In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
Affected: Jetbrains Teamcity before 2026.1.3, 2025.11.7
Fix: Upgrade Jetbrains Teamcity to 2026.1.3 or 2025.11.7 (whichever matches your release line), or later.
Exploitation: Exploited in the wild

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Jetbrains Teamcity: Red, act today. In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

The flaws

CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability (CVSS 9.8 · exploited)
CVE-2026-111094: Unsafe deserialisation can lead to remote code execution (CVSS 9.8 · EPSS 0%)
CVE-2026-100255: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was… (CVSS 9.8 · EPSS 0%)
CVE-2026-106218: In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the… (CVSS 10.0 · EPSS 0%)

The fix

Upgrade Jetbrains Teamcity: 2026.1.3 · 2025.11.7 · 2026.2 · 2026.1.4 · 2025.11.8 or later on your release line

Who is exposed: Jetbrains Teamcity before 2026.1.3, 2025.11.7

Where it stands

Exploited in the wild
On CISA's exploited list since 5 Aug
US federal deadline 8 Aug

How it unfolded

5 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
8 Aug, Deadline (official): US federal agencies must have patched

Connects to

Same weakness: Unsafe deserialisation (CWE-502). 249 other warnings in 30 days
Same product: Earlier Jetbrains Teamcity warnings. 5 in the last 90 days

Why it is Red

CVSS 9.8 critical
Exploited in the wild (CISA KEV)
Used in ransomware campaigns
Remotely exploitable without logging in

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

Original description

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Last activity 5 Aug 2026. Patch Forecast updates every hour.