Rapid7 publishes analysis of critical TeamCity RCE vulnerability

Rapid7 has published an analysis of CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in JetBrains TeamCity. The flaw is an unsafe deserialization issue in the agent polling protocol, allowing an attacker to execute operating system commands with the privileges of the TeamCity server process.

JetBrains disclosed the vulnerability on July 27, 2026, and released a patch in version 2026.1.3. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 5, 2026, confirming exploitation in the wild.

Rapid7’s analysis attributes the root cause to a permissive XStream allowlist in vulnerable TeamCity versions, which fails to remove default permissions. The patch remediates the issue by clearing those defaults.