TeamCity CVE-2026-63077: CVSS 9.8 Unauthenticated RCE Exposes CI/CD Supply Chain, Patch Before August 8

CVE-2026-63077 is a deserialization of untrusted data vulnerability in the TeamCity agent polling protocol. TeamCity build agents -- the worker nodes that execute build tasks -- communicate with the central server over an HTTP channel the server exposes for agents to poll for instructions. The server processes incoming agent protocol messages by deserializing them as Java objects. That deserialization happens before any authentication check runs.

Java deserialization attacks follow a consistent exploitation path. An attacker uses a tool like ysoserial to generate a serialized Java object embedding a gadget chain -- a sequence of constructors and method calls in libraries already present on the target server's classpath. When Java's ObjectInputStream deserializes the payload, it instantiates and invokes those classes in order, producing arbitrary code execution as a side effect. The attacker controls the code.

The full exploit for CVE-2026-63077 requires exactly one network request. No prior authentication, no registered agent certificate, no valid session token. The attacker sends an HTTP POST to the agent polling endpoint with the serialized payload as the request body. The server deserializes it, the gadget chain fires, and the attacker has OS command execution under the TeamCity server process.

On Windows, TeamCity typically runs as a service under SYSTEM or LocalSystem privileges. On Linux, it runs as the teamcity service account, which holds full read-write access to the TeamCity configuration database, build configuration files, secrets vault, and artifact storage. Both environments give an attacker immediate access to the credentials and repositories connected to the build server.

JetBrains confirmed the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -- network-reachable, low attack complexity, no privileges required, no user interaction. Every internet-facing TeamCity On-Premises server before the patched versions is a live exposure.

All organizations running JetBrains TeamCity On-Premises before versions 2025.11.7 or 2026.1.3 are affected. TeamCity Cloud is not affected; JetBrains patched the cloud infrastructure directly. The vulnerability reaches back to TeamCity 2017.1 -- any on-premises deployment that has not upgraded or applied the security patch plugin is vulnerable.

The highest-risk configurations are TeamCity servers with direct internet access and no authentication layer in front of the agent polling port. Organizations that expose TeamCity over a public IP, through a cloud load balancer without WAF, or behind a reverse proxy that passes all HTTP methods without restriction fall into this category.

CISA's three-day remediation window -- from the August 5 KEV addition to the August 8 deadline -- reflects high confidence in ongoing active exploitation. The same pattern appeared during the September 2023 TeamCity exploitation wave (CVE-2023-42793), when APT29 and Lazarus Group began mass exploitation within days of a patch release. Shodan and Censys indexing of TeamCity endpoints made automated targeting trivial.

Organizations that run TeamCity on internal networks without internet exposure have a narrower window but are not immune. Once an attacker gains initial network access via phishing or another entry point, an unpatched internal TeamCity server becomes an instant credential vault and lateral movement platform. Every VCS token, cloud API key, and code signing certificate stored in TeamCity's secret management is exposed.

For MSPs and software vendors who build and distribute products through TeamCity, the downstream blast radius extends to every customer who installs those products. The N-central CVE-2026-18577 MSP supply chain exploit demonstrated how a single RMM platform compromise cascades to thousands of managed endpoints. A compromised CI/CD pipeline creates the same downstream exposure for software consumers.

The attack chain for CVE-2026-63077 is short and fully automated. Threat actors running opportunistic campaigns follow the same six-step sequence across all targeted organizations.

No CVE-2026-63077-specific Sigma rule exists in SigmaHQ at time of writing. The CVE was disclosed July 27, 2026, and the SigmaHQ community typically takes one to three weeks to publish a CVE-tagged rule after public exploitation details emerge.

Two behavior-based rules from SigmaHQ detect the post-exploitation activity this CVE produces. The Linux auditd rule fires on any execve or execveat syscall by the web server user (UID 33 by default for www-data; adjust to your TeamCity service user ID). The Windows rule detects suspicious child processes spawned from java.exe, which is the process TeamCity runs under on Windows. Both rules require your log source to be configured correctly: on Linux, auditd must include execve rules for the TeamCity user's UID; on Windows, Sysmon process creation logging (Event ID 1) must be active.

Deploy both rules in your SIEM in detection-only mode first. TeamCity may legitimately spawn some Java child processes during build tasks, so review the baseline before switching to alert-on-first-match. The WAF rules below block the deserialization payload at the network layer before it reaches the server, providing a defense-in-depth layer independent of endpoint logging.

JetBrains released patched versions and a standalone security patch plugin on July 27, 2026. The remediation path is straightforward. Follow these steps in order.

CVE-2026-63077 is not a narrow server vulnerability. It is an attack against the trust chain between your build system and everyone who uses the software it produces.

When a CI/CD server is compromised, the attacker does not need to breach each downstream consumer separately. They modify the artifact at the source, before it is signed and distributed. Every customer, partner, or internal team that deploys a binary built on the compromised server receives a potentially backdoored package. The 2020 SolarWinds SUNBURST campaign is the canonical example: attackers inserted a backdoor into SolarWinds Orion build artifacts and used the company's existing distribution infrastructure to deliver it to 18,000 organizations. CVE-2026-63077 creates the same entry point on any organization running an unpatched, reachable TeamCity server.

The attackers who exploited the 2023 TeamCity CVE-2023-42793 authentication bypass -- APT29 and the Lazarus Group -- demonstrated exactly what follows successful CI/CD compromise: mass exfiltration of stored credentials, insertion of backdoored code into build configurations, and lateral movement into connected repository hosts and cloud accounts. Both groups exploited that vulnerability at scale within days of the patch release, using automated tooling to identify and compromise unpatched servers before defenders could respond.

The pattern with IBM Langflow CVE-2026-9198 last week reinforces the timeline: CISA KEV addition followed by aggressive active exploitation, with a short mandatory deadline signaling the agency's confidence in ongoing campaigns. Organizations that treat CISA deadlines as federal-only compliance requirements consistently find themselves behind the remediation curve when their own incident response teams are briefing executives.

Friday afternoon is exactly when threat actors expect security teams to slow down. Patch before end of day. Rotate credentials. Audit artifacts. Then spend the weekend confident the attack surface is closed.