THREAT OPS › CVEs › CVE-2026-63077
CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
Vulnerability details
- Affected productsTeamCity
- KEV remediation due2026-08-08
Related reporting
- Metasploit Wrap Up: This One Goes to Sixteen!rapid7
- August 2026 CVE Landscaperecordedfuture
- Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)rapid7
- CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wildthehackernews
- CISA Adds One Known Exploited Vulnerability to Catalogcisa_advisories
- [CISA KEV] CVE-2026-63077 — JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerabilitycisa_kev
- 3rd August – Threat Intelligence Reportcheckpoint_research
- CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCityrapid7
- Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging Inthehackernews