JetBrains TeamCity under active exploitation: CVE-2026-63077

On 2026-08-05, CISA added CVE-2026-63077 to the Known Exploited Vulnerabilities (KEV) catalog. The entry describes a deserialization-of-untrusted-data vulnerability in JetBrains TeamCity that permits unauthenticated remote code execution over the agent polling protocol. KEV inclusion is not a severity judgment; it is a declaration that CISA has evidence of exploitation in the wild. For Federal Civilian Executive Branch agencies, BOD 22-01 converts that declaration into a hard remediation deadline. For everyone else, KEV inclusion is the strongest public signal that a vulnerability is actively exploited.

This post covers what the flaw is, why CISA's exploitation determination is credible on its face, how to check whether your TeamCity footprint is exposed, and what to do inside the deadline window. It also situates CVE-2026-63077 among the other seven KEV additions made in the days before it, because build-system compromise rarely happens in isolation.

What the flaw is

CISA's KEV summary describes CVE-2026-63077 as a deserialization-of-untrusted-data vulnerability reachable through the agent polling protocol, exploitable without authentication for remote code execution. Three attributes matter to defenders:

• Deserialization of untrusted data. This vulnerability class turns wire bytes into live objects. When gadget chains exist in the classpath (and in a Java build server they almost always do), an attacker who controls the serialized payload controls the process.
• Agent polling protocol. TeamCity build agents reach out to the server on a defined channel to pick up work. Any interface designed to accept agent connections is network-reachable inside the environments where TeamCity is deployed, and is frequently reachable from broader network zones because agents run on developer laptops, cloud runners, and third-party VMs.
• Unauthenticated. No credential theft or session replay is required. The attacker sends bytes; the server executes code.

This combination makes the KEV entry consequential. A build server is a credential vault (VCS tokens, cloud deploy keys, signing material, artifact-registry credentials) and an artifact producer whose outputs downstream systems trust by default. RCE on the CI controller is a supply-chain event.

Why CISA's active-exploitation call is credible on its face

CISA adds an entry to KEV only when there is reliable evidence of exploitation in the wild. The technical profile of CVE-2026-63077 matches bugs that get weaponized quickly:

1. The vulnerable surface is a protocol endpoint, not a user-facing web form, so exploitation is trivially scriptable.
2. Deserialization RCE tends to be reliable across patch levels of the underlying runtime, because gadget chains persist across minor versions.
3. TeamCity historically appears in internet-facing footprints; developers expose the server to home networks and remote agents, making Shodan-class discovery straightforward.
4. Build servers are high-value targets: threat actors focused on code-signing abuse, artifact tampering, and lateral movement into cloud tenants consistently target CI infrastructure.

Absent contradictory data, treat KEV inclusion as authoritative and skip the debate about whether a proof-of-concept counts as "in the wild."

How to tell whether you are affected

Start with an inventory pass. TeamCity is often deployed once by a platform team and left untracked as ownership rotates. The following commands cover the common discovery paths:

# 1. Locate TeamCity servers on the network (default HTTPS port 8111 plus common overrides).
nmap -p 8111,80,443,8080,8443 --script http-title -oA teamcity-scan 10.0.0.0/8

# 2. On known hosts, confirm the running version and installed plugins.
curl -sk https://teamcity.internal/app/rest/server \
  -H 'Accept: application/json' | jq '{version, versionMajor, versionMinor, buildNumber}'

# 3. Enumerate exposed agent-protocol listeners.
ss -tlnp | grep -E ':(9090|8111)\b'

# 4. Pull recent authentication and build-configuration audit events.
find /var/log/teamcity /opt/TeamCity/logs -name 'teamcity-*.log' -mtime -30 \
  -exec grep -Ei '(agent.*regist|deserializ|classcast|invoke.*Runtime|Base64.*rO0)' {} +

The rO0 marker in the last grep is the Base64 prefix for Java serialized-object streams (AC ED 00 05) and is a common indicator of serialized payloads appearing where they should not. Its presence in HTTP request bodies, agent-protocol traffic, or exception traces is a lead, not a conclusion; benign serialized traffic exists too.

Cross-reference the version returned in step 2 against the JetBrains security advisory for CVE-2026-63077. Treat any TeamCity server whose agent port is reachable from a broader network zone as exposed until proven otherwise.

What to do inside the remediation deadline

BOD 22-01 requires FCEB agencies to remediate KEV entries within CISA's assigned timeline. Non-federal operators should adopt the same discipline; attacker tempo does not vary by jurisdiction. Ordered by expected time-to-value:

1. Patch to the fixed TeamCity build identified in the JetBrains advisory for CVE-2026-63077. This is the only durable remediation for a deserialization flaw; network controls are stopgaps.
2. If you cannot patch immediately, restrict agent-protocol reachability to the IP ranges of known agents at the firewall or reverse proxy. Do not rely on the server's own allow-list configuration until the patched build is in place.
3. Rotate every secret the server has touched. Assume compromise if the server was internet-reachable during the exposure window: VCS access tokens, cloud provider credentials, container-registry push credentials, signing keys, SSH deploy keys, and any secrets injected into build steps.
4. Audit produced artifacts. Re-verify from source, or rebuild on a clean controller, any artifact produced during the exposure window. Confirm signatures against a known-good key generated after rotation.
5. Hunt for persistence. Look for new build configurations, new administrator accounts, SSH keys added under the TeamCity service account, and unexplained plugin installations. TeamCity's audit log at /admin/admin.html?item=audit is the fastest starting point.

Situating this KEV among its neighbors

CVE-2026-63077 did not land in isolation. In the seven days before 2026-08-05, CISA also added CVE-2026-9198 (IBM Langflow unauthenticated RCE), CVE-2026-34486 (Apache Tomcat, chainable with CVE-2025-24813), CVE-2026-18556 and CVE-2026-18577 (N-able N-central authentication bypass, the latter an incomplete-patch follow-up to the former), and CVE-2026-20316 (hard-coded password in Cisco Secure Firewall Management Center).

Two patterns stand out. First, incomplete patches remain a recurring failure mode: CVE-2026-18577 exists precisely because the fix for CVE-2026-18556 was insufficient. Verify every remediation with a positive test, not just a version-string check. Second, five of these entries sit on infrastructure that platform and security teams themselves operate: a build server, an ML orchestration server, an application server, an RMM platform, and a firewall manager. The tooling defenders rely on is inside the blast radius.

Treat the KEV catalog as your standing worklist: patch, verify, and prove the fix under adversary assumptions.

Verifiable security.