RAPID 7's analysis reveals a critical unauthenticated remote code execution vulnerability (CVE-2026-63077) in JetBrains TeamCity, disclosed on July 27, 2026. An attacker can exploit this vulnerability over HTTP or HTTPS, allowing them to execute commands with the same privileges as the TeamCity server process. JetBrains initially reported no known active exploitation, but CISA later added it to their Known Exploited Vulnerabilities catalog after confirming exploitation in the wild.
The vulnerability stems from an unsafe deserialization issue due to TeamCity's incorrect handling of XStream permissions in version 2026.1.2. A patch in version 2026.1.3 addressed this by clearing default permissions for deserialization. The analysis includes details of how exploitation occurs via unauthorized XML requests, creating a gadget chain leading to command execution. A proof-of-concept script is available, demonstrating the exploitation process. Organizations are advised to apply the patch to remediate the vulnerability.