CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data

What is CVE-2026-63077?

CVE-2026-63077 is a critical unsafe deserialization vulnerability in Jetbrains Teamcity, published on 27 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Weakness: CWE-502

Which versions are affected by CVE-2026-63077?

It affects 1 product.

Products include Jetbrains Teamcity.

How do I fix CVE-2026-63077?

No fix has been published for CVE-2026-63077 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 8 Aug 2026.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-63077 being exploited?

Yes. Attackers have exploited CVE-2026-63077 in the wild since at least 5 Aug 2026, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 7 proofs of concept on GitHub.

Other vulnerabilities in Jetbrains Teamcity

• CVE-2024-27198 JetBrains TeamCity Authentication Bypass Exploited Critical 9.8
• CVE-2023-42793 JetBrains TeamCity Authentication Bypass Exploited Critical 9.8
• CVE-2024-27199 JetBrains TeamCity Relative Path Traversal Exploited High 7.3
• CVE-2024-23917 Auth bypass in TeamCity Critical 9.8
• CVE-2022-24331 Auth bypass in n/a Critical 9.8

All Jetbrains Teamcity vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-94gx-v738-fx9w.