CVE-2026-63077: JetBrains TeamCity Unauthenticated Remote Code Execution - What It Means for Your Business and How to Respond
Introduction
CVE-2026-63077 is a critical vulnerability in JetBrains TeamCity that allows attackers to take full control of affected servers without any login credentials. TeamCity is a widely used continuous integration and continuous delivery platform that sits at the heart of software development pipelines for organizations of all sizes across the United States and Canada. When compromised, it can expose source code, credentials, build artifacts, and downstream deployment processes. This issue matters because many companies treat their build servers as internal infrastructure and may not apply the same urgency to them as customer-facing systems. Organizations running on-premises TeamCity installations are at direct risk, particularly those with servers reachable from the internet or less restricted internal networks. This post explains the business implications, provides practical scenarios, helps you determine exposure, and outlines clear next steps. Technical details appear only in the appendix for security and IT professionals.
S1 — Background & History
JetBrains disclosed CVE-2026-63077 on July 27, 2026. The vulnerability affects JetBrains TeamCity On-Premises installations prior to versions 2026.1.3 and 2025.11.7. It received a CVSS score of 9.8, the highest severity rating, and is classified as a critical issue involving the unsafe handling of data in the agent polling protocol that build agents use to communicate with the central server. In plain language, an attacker who can reach the server over the network can execute arbitrary commands with the same privileges as the TeamCity process itself, without needing a username or password. JetBrains served as the official reporter through its coordinated disclosure process. Key timeline events include the initial public advisory on July 27, confirmation of active exploitation in the wild, and addition of the vulnerability to the CISA Known Exploited Vulnerabilities catalog on August 5, 2026. A security patch plugin was also made available for older supported releases so organizations could protect systems without an immediate full upgrade. TeamCity Cloud customers were not affected.
S2 — What This Means for Your Business
For business leaders in the United States and Canada, this vulnerability translates into direct threats to operations, data integrity, reputation, and regulatory standing. A successful attack can halt software delivery pipelines, delaying product releases, customer updates, and internal projects that depend on continuous builds. Attackers who gain control of the TeamCity server can access source code repositories, stored credentials, API keys, and signing certificates. This opens pathways to intellectual property theft, supply-chain compromise of software you distribute, and further movement into production environments. Reputation damage follows quickly when customers or partners learn that compromised builds may have introduced malicious changes. From a compliance perspective, organizations subject to frameworks such as SOC 2, ISO 27001, PCI DSS, or sector-specific requirements in finance, healthcare, or critical infrastructure face potential findings, audit failures, or breach notification obligations if sensitive data or systems are exposed. Even internal-only deployments carry risk if network segmentation is incomplete or if remote workers and contractors can reach the server. The combination of no authentication requirement and confirmed exploitation in the wild elevates this from a theoretical concern to an immediate operational priority.
S3 — Real-World Examples
Regional Financial Services Firm: A mid-sized bank running TeamCity for internal application builds experiences an unauthenticated intrusion. Attackers extract database connection strings and cloud credentials stored in the CI environment, then use them to access customer transaction data systems. Operations teams spend weeks validating build integrity while regulators open inquiries into potential data exposure.
Software Product Company: A Canadian SaaS provider with internet-reachable TeamCity servers is compromised. Malicious code is injected into a customer-facing release candidate. After discovery, the company must issue emergency patches, notify customers, and face temporary loss of trust that affects renewal rates and new sales.
Healthcare Technology Organization: A hospital-affiliated development team uses TeamCity for medical device software pipelines. Exploitation allows an attacker to modify build scripts and introduce unauthorized changes. The organization faces delayed certifications, potential patient safety reviews, and significant legal exposure under health privacy regulations.
Mid-Market Manufacturing Enterprise: A US manufacturer relies on TeamCity for industrial control software updates. After compromise, build agents are registered and used to stage further attacks on plant floor systems. Production lines experience downtime while forensic teams isolate affected components and restore trusted build processes.
S4 — Am I Affected?
Key Takeaways
Call to Action
Protect your development infrastructure and the business processes that depend on it. IntegSec helps organizations across the United States and Canada identify exposure, validate remediation, and strengthen overall security posture through professional penetration testing. Contact us today at https://integsec.com to schedule an assessment focused on your continuous integration environment and reduce residual risk with confidence.
TECHNICAL APPENDIX (security engineers, pentesters, IT professionals only)
A — Technical Analysis
CVE-2026-63077 is a deserialization of untrusted data vulnerability (CWE-502) in the agent polling protocol of JetBrains TeamCity. The root cause lies in the server-side handling of serialized objects received over the unauthenticated agent communication endpoints, typically under paths related to /app/agents. TeamCity relies on XStream for object serialization and reconstruction. The allowlist intended to restrict deserializable classes incorrectly retained permissive defaults, enabling gadget chains present in the classpath to execute arbitrary code. The attack vector is network-based (AV:N), requires low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N). Scope remains unchanged (S:U) while confidentiality, integrity, and availability impacts are all high (C:H/I:H/A:H), producing the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector and 9.8 score. Official references include the JetBrains security advisory and the NVD entry for CVE-2026-63077.
B — Detection & Verification
Administrators can enumerate the running version through the TeamCity web interface under Administration or via server logs and the REST API where available. Public scanners and Nuclei templates target the agent endpoints with crafted payloads that trigger out-of-band interactions. Log indicators include entries containing com.thoughtworks.xstream.converters.ConversionException or, after patching, com.thoughtworks.xstream.security.ForbiddenClassException. Behavioral anomalies include unexpected registration of build agents, particularly those with names beginning with “scan”, and anomalous process execution under the TeamCity service account. Network indicators consist of unauthenticated POST requests to agent polling paths carrying serialized Java object streams, often with Content-Type application/octet-stream and User-Agent strings mimicking TeamCity agents.
C — Mitigation & Remediation
D — Best Practices