Known vulnerability record

CVE-2026-63077

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Stable IDcve:CVE-2026-63077Source record date2026-08-06Human reviewNot recordedProvenanceSource-linked CVE, KEV, and EPSS signals

Summary

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.

Vulns.co field classification

Code execution on build and delivery

Derived analysis: these labels are inferred from the source title, product, and summary. They are not vendor, CVE, CISA, or FIRST classifications.

Failure classCode execution

Product laneBuild and delivery

Attention stateKnown exploited, ransomware use unknown

Hunter pivot

Establish the exact reachable primitive and its preconditions. Use a harmless marker if authorized, preserve a clean control, and stop before persistence, secret access, or lateral movement.

Signals

Keep the signals separate

CVSS severitycriticalScore 9.8 · source JetBrains

EPSS probability84.7%Probability of exploitation in the next 30 days; not severity

CISA KEVKnown exploitedAdded 2026-08-05

Ransomware useunknownPreserved as known / unknown, not a truthy default

Research boundary

Confirm the product before the behavior.

Match the exact product, build, deployment mode, and exposed component.
Read the vendor advisory and current program policy.
Choose one non-destructive discriminator with an explicit negative control.
Stop at the first sufficient proof. A CVE match is context, not permission.

Timeline

Dates and provenance

CVE published: 2026-07-27
CVE modified: 2026-08-06
KEV date added: 2026-08-05
Dataset fetched: 2026-08-25T13:17:16.571Z

Sources

Original records

Version history: normalized permanent page created 2026-08-20. Machine-enriched fields remain source-attributed.