CISA KEV Adds JetBrains TeamCity Deserialization Flaw (CVE-2026-63077) — Actively Exploited

JetBrains has disclosed CVE-2026-63077, a deserialization of untrusted data vulnerability in TeamCity that could allow unauthenticated remote code execution via the agent polling protocol. CISA has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, indicating it is being actively exploited in the wild. No CVSS score has been published at this time, and whether the vulnerability has been used in ransomware operations is currently unknown.

Why It Matters

TeamCity is widely used as a CI/CD build server, often with privileged access to source repositories, build agents, artifact stores, and deployment credentials. Unauthenticated RCE against a build server is a high-value target for attackers seeking to pivot into software supply chains — compromising TeamCity can enable code injection into build pipelines, theft of signing keys and secrets, and lateral movement into downstream environments. Any organization running an internet-facing or otherwise exposed TeamCity server, and its agents, should treat this as urgent.

What Defenders Should Watch For

• Inventory all TeamCity server and agent instances, and confirm exposure (internet-facing or internal-only).
• Monitor the agent polling protocol/communication channel for anomalous or malformed serialized payloads and unexpected connections from unrecognized agents.
• Watch for unexpected child processes spawned by TeamCity server or agent processes, new scheduled tasks/services, or unfamiliar build steps and plugins added to projects.
• Review authentication and access logs for unusual agent registration or polling activity, and audit outbound connections from build infrastructure for signs of secondary payload retrieval.
• Apply JetBrains' patch or mitigation guidance as soon as it is available, and consider isolating TeamCity server/agent network segments in the interim.

This is a developing, same-day KEV addition and details are still emerging — treat specifics around patch availability, affected version ranges, and exploitation TTPs as provisional until confirmed. For the authoritative advisory, see JetBrains' post: https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/.