Full Report
A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability in question is CVE-2026-63077 (CVSS score: 9.8), a case of deserialization of untrusted data that could allow an unauthenticated attacker with access to a TeamCity server
Analysis Summary
# Vulnerability: Critical Deserialization Flaw in JetBrains TeamCity
## CVE Details
- **CVE ID:** CVE-2026-63077
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
- **Products:** JetBrains TeamCity (On-premise versions)
- **Versions:** Impacting all versions prior to the latest security patch (refer to vendor documentation for specific version range).
- **Configurations:** Systems exposed to network access (specifically those accessible via the web interface or API).
## Vulnerability Description
The flaw stems from a **deserialization of untrusted data** vulnerability. In TeamCity, certain endpoints fail to properly validate or sanitize serialized objects provided by a user. An unauthenticated attacker can send a specially crafted request containing malicious serialized data. When the server processes this data, it can lead to arbitrary code execution (RCE) in the context of the TeamCity service account.
## Exploitation
- **Status:** **Exploited in the wild.** CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
- **Complexity:** Low
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** Total (Full access to server data and source code)
- **Integrity:** Total (Ability to modify build pipelines and artifacts)
- **Availability:** Total (Ability to shut down or ransom the server)
## Remediation
### Patches
- JetBrains has released security updates to address this flaw. Users are urged to upgrade to the latest stable version of TeamCity immediately.
- If a full upgrade is not possible, check for the **TeamCity Security Search plugin** which JetBrains often releases to patch specific CVEs on older versions.
### Workarounds
- Restrict access to the TeamCity server to trusted IP addresses via firewall/VPN.
- Place the TeamCity server behind a Web Application Firewall (WAF) with rules configured to block common Java deserialization patterns.
## Detection
- **Indicators of Compromise:** Look for unusual child processes spawned by the TeamCity service (e.g., `cmd.exe`, `/bin/sh`, `powershell.exe`).
- **Detection methods and tools:**
- Review TeamCity access logs for suspicious requests to endpoints handling serialized objects.
- Monitor for unauthorized creation of new administrative accounts or unexpected changes to build configurations.
## References
- **Vendor Advisory:** hxxps[://]blog[.]jetbrains[.]com/teamcity/
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-63077