JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution

JetBrains TeamCity 2026.1.3, 2025.11.7 contains a remote code execution caused by unsafe XStream deserialization in the unauthenticated agent polling protocol. The XStream instance serving /app/agents/v1 is created without NoTypePermission.NONE, so XStream's default type permissions Throwable, Ma...

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild

A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency CISA. The vulnerability in question is CVE-2026-63077 CVSS score: 9.8, a case of deserialization...

VulnCheck KEV: CVE-2026-63077

JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol...

JetBrains TeamCity < 2025.11.7 / 2026.x < 2026.1.3 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.7, or prior to 2026.1.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...

CVE-2026-63077

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...

CVE-2026-63077

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...

CVE-2026-63077

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...

CVE-2026-63077

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...

PT-2026-65062

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2026.1.3 JetBrains TeamCity versions prior to 2025.11.7 Description An unauthenticated remote attacker can execute arbitrary operating system commands with the privileges of the TeamCity Server process by...

CVE-2026-63077: Deserialization of Untrusted Data

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...