Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)

A critical vulnerability in JetBrains TeamCity, identified as CVE-2026-63077, allows unauthenticated remote code execution, enabling attackers to execute operating system commands with the same privileges as the TeamCity server process. This unsafe deserialization vulnerability can be exploited by attackers who can reach the TeamCity server over HTTP or HTTPS, without requiring any credentials. Although JetBrains initially reported no known active exploitation, the vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on August 5, 2026¹, indicating potential active exploitation. The vulnerability affects TeamCity servers, allowing attackers to gain control and execute malicious commands. This vulnerability matters to practitioners because its exploitation status determines the urgency of patching, making it essential to monitor and address the vulnerability promptly to prevent potential attacks.