CVE‑2026‑63077: JetBrains TeamCity Deserialization of Untrusted Data Leads to Unauthenticated Remote Code Execution
What It Is — JetBrains TeamCity contains a deserialization‑of‑untrusted‑data flaw in its agent‑polling protocol. An attacker can send crafted data without authentication and achieve remote code execution on the TeamCity server. The issue is tracked as CVE‑2026‑63077 and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
Exploitability — The vulnerability is remotely exploitable over the network; proof‑of‑concept code is publicly available. No large‑scale ransomware‑as‑a‑service activity has been observed yet, but its KEV inclusion signals a high likelihood of active exploitation. NVD assigns a CVSS v3.1 base score of 9.8 (Critical).
Affected Products — JetBrains TeamCity (all supported on‑premise versions prior to the vendor‑released patch; see JetBrains advisory for exact version range).
Why It Matters for Trust & Control Assurance
- Control monitoring: The flaw underscores the need for continuous evidence that secure‑coding and input‑validation controls are in place and operating.
- Patch management evidence: Demonstrating timely remediation is a core audit artifact that enterprise buyers now demand.
- Supply‑chain trust: A single vulnerable CI/CD component can invalidate the broader trust posture of a software supply chain, affecting downstream compliance attestations.
Recommended Actions
- Apply JetBrains’ security patch immediately and verify the version is no longer vulnerable.
- Restrict the agent‑polling endpoint to trusted IP ranges or VPN access.
- Update your control‑mapping inventory to include secure coding / input validation controls and capture remediation evidence in your Trust Center.
- Conduct a focused control‑effectiveness test to confirm the vulnerability is fully mitigated.
Source: CISA KEV – CVE‑2026‑63077