CVE-2026-63077 · High · CISA KEV

JetBrains TeamCity Deserialization RCE: Unauthenticated Threat via Agent Polling

Threat Engine Auto-Feed · data current as of 2026-08-06

A deserialization of untrusted data vulnerability in JetBrains TeamCity allows unauthenticated remote code execution through the agent polling protocol. This flaw is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog, indicating a high exploitation pressure.

  • CVSS:
  • EPSS percentile: 0.59783
  • Exploitation pressure: 61/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 60th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves 'deserialization of untrusted data.' This occurs when an application takes data from an untrusted source, converts it from a stored format back into an object, and then executes code based on that object. If an attacker can control the data being deserialized, they can inject malicious code that the application will then execute, leading to severe compromise.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using JetBrains TeamCity, especially those with publicly exposed instances or agents.
  • Financial services organizations, due to documented targeting by financially motivated threat actors.
  • Technology sector companies, given the focus of state-sponsored and sophisticated criminal groups on this industry.

Misconfigurations that escalate it

  • Any setup where TeamCity agents communicate over an unmonitored or untrusted network segment.
  • Lack of network segmentation between TeamCity servers/agents and less secure parts of the infrastructure.

High-impact scenarios

  • An unauthenticated attacker gaining remote code execution on the TeamCity server or agents, leading to full system compromise.
  • Lateral movement within the network from a compromised TeamCity instance to other critical development or production systems.
  • Data exfiltration or deployment of ransomware across the development pipeline and connected environments.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor network traffic for unusual patterns or connections to/from TeamCity servers and agents, particularly on the agent polling protocol.
  • Regularly review TeamCity server and agent logs for suspicious activity, unexpected process execution, or deserialization errors.
  • Implement intrusion detection systems (IDS) to flag known malicious patterns or anomalies related to deserialization attacks.

Contain

  • Isolate affected TeamCity instances and agents from the network to prevent further compromise.
  • Block all external access to the TeamCity agent polling protocol if not strictly necessary.
  • Review and revoke any potentially compromised credentials or API keys associated with the TeamCity environment.

Patch

  • Apply the latest security updates and patches provided by JetBrains for TeamCity immediately.
  • Ensure all TeamCity agents are also updated to compatible, patched versions.

Frontier verdict — High

This vulnerability is critical due to unauthenticated remote code execution, active exploitation in the wild (CISA KEV), and a high exploitation pressure score, demanding immediate patching.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.