CVE-2026-63077: JetBrains TeamCity Deserialization RCE Added to CISA KEV

Executive Summary

A critical deserialization vulnerability (CVE-2026-63077) in JetBrains TeamCity enables unauthenticated remote code execution via the agent polling protocol. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.

Organizations running TeamCity CI/CD servers are urged to apply vendor patches immediately.

Vulnerability Overview

Affected Versions

Apply the vendor-supplied patch immediately. Consult JetBrains security advisories for the exact fixed build number.

Technical Analysis

TeamCity uses an internal binary protocol for build agent polling — agents periodically connect to the server to request new build tasks. The vulnerable endpoint deserializes data sent by polling agents without adequate validation.

The attack flow:

1. Attacker sends crafted serialized object to the agent polling endpoint
2. TeamCity deserializes the payload without allowlist validation
3. Deserialization gadget chain executes attacker-supplied commands
4. Full RCE achieved in the context of the TeamCity server process
5. Attacker gains access to all build pipelines, secrets, and source code

Why This Is Severe for CI/CD Environments

TeamCity servers are high-value targets because they:

• Hold source code secrets — API keys, signing certificates, cloud credentials
• Have write access to repositories through configured VCS integrations
• Can modify build pipelines to inject malicious artifacts into the software supply chain
• Often run with elevated OS privileges to perform deployments

Immediate Remediation

Step 1: Apply the JetBrains Patch

Check your installed TeamCity version and apply the official security update:

# Check running TeamCity version
curl -s http://localhost:8111/app/rest/server | grep -o '"version":"[^"]*"'
 
# Or check the admin UI
# Administration > Server Administration > Server Info

Download and apply the patch from the JetBrains security page.

Step 2: Network Isolation

While patching, immediately restrict access to the agent polling port:

# Block external access to TeamCity agent port (default 9090)
iptables -I INPUT -p tcp --dport 9090 ! -s <trusted_agent_cidr> -j DROP
 
# Or restrict via firewall/security group rules
# Only allow known build agent IP ranges

Step 3: Audit for Compromise Indicators

# Check for unexpected processes spawned by TeamCity
ps aux | grep -E "teamcity|java" | grep -v "grep"
 
# Review TeamCity server logs for anomalous deserialization activity
grep -i "deseri\|ClassLoader\|ObjectInputStream" /path/to/teamcity/logs/teamcity-server.log | tail -100
 
# Check for new admin accounts
# Administration > Users > filter by recent creation date
 
# Audit recent builds for unexpected changes
# Build History > filter by date > review build scripts

Step 4: Rotate All Build Secrets

Assume all secrets stored in TeamCity have been compromised:

# Rotate secrets in order of blast radius:
# 1. Cloud provider API keys (AWS, GCP, Azure)
# 2. Code signing certificates
# 3. Container registry credentials
# 4. Deployment SSH keys
# 5. Database connection strings
# 6. Third-party service tokens

Detection

Workaround (If Immediate Patching Is Not Possible)

1. Take TeamCity offline or restrict to VPN/internal access only.
2. Block the agent polling port (default: 9090) from all external IP addresses at the network perimeter.
3. Disconnect build agents from the internet-facing server until patched.
4. Enable detailed audit logging and monitor for anomalous behavior.

References

• CISA Known Exploited Vulnerabilities Catalog
• NVD — CVE-2026-63077
• JetBrains Security Advisories
• CWE-502: Deserialization of Untrusted Data

Related Reading

• CVE-2026-66902: Google::Auth Perl Command Injection