Actively exploited in the wild
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrains - TeamCity · Listed in the CISA KEV since 2026-08-05. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-63077
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
In JetBrains TeamCity before versions 2026.1.3 and 2025.11.7, unauthenticated remote code execution is possible via the agent polling protocol.
Risk Assessment
An unauthenticated attacker can remotely execute arbitrary code on the TeamCity server, potentially leading to full system compromise.
Recommendation
Immediately update JetBrains TeamCity to version 2026.1.3 or later (or 2025.11.7 depending on the branch).
Other vulnerabilities in JetBrains TeamCity
See all- CVE-2026-65907Critical
In JetBrains TeamCity before 2026.1.2 and 2025.11.6, code execution in Git VCS roots was possible.
- CVE-2024-27198CriticalActively exploited
In JetBrains TeamCity before 2023.11.4, an authentication bypass vulnerability exists that allows performing admin actions without authorization.
- CVE-2023-42793CriticalActively exploited
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible.
- CVE-2023-41249Medium
In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during copying Build Step.
- CVE-2023-34225Medium
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the NuGet feed page.
- CVE-2023-34220Medium
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the Commit Status Publisher window.
- CVE-2023-34218Critical
In JetBrains TeamCity before version 2023.05, it was possible to bypass permission checks, allowing for the execution of admin actions.
- CVE-2026-111096Medium
In JetBrains TeamCity before 2026.2, 2026.1.4, and 2025.11.8, stored XSS in the classic build log was possible. Malicious content stored in the log can execute in the browser of a user viewing the log.
- CVE-2026-111095High
JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 contains a stored XSS vulnerability in the classic project overview. This may allow script execution in a user's browser.
- CVE-2026-111094High
JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 contains a remote code execution vulnerability via a whitelist bypass in the build messages protocol. This may lead to arbitrary code execution on the server.
Original NVD description (English source)
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
Vulnerability data from NVD (NIST) · CISA KEV · EPSS