CVE-2026-63077 is a CVSS 9.8 unauthenticated remote code execution flaw in on-premise JetBrains TeamCity, caused by an XStream allowlist that added TeamCity classes without removing XStream's permissive defaults. CISA added it to the KEV catalog on August 5 with a federal patch deadline of August 8.
Read the full story: CISA Flags TeamCity RCE: An XStream Allowlist Left Open →
Transcript
The bug is one missing line. TeamCity's agent polling protocol deserializes data with XStream, and the code that set up the allowlist added TeamCity's own classes without first clearing XStream's defaults. An allowlist that only ever adds is not an allowlist. It is a union, and that union stayed wide enough to load classes an attacker controls. The result is unauthenticated remote code execution on the build server, rated nine point eight. CISA added it to the known exploited catalog on August fifth and gave federal agencies until the eighth. Three days. And remember what a build server actually holds. Source tokens. Cloud credentials. Signing keys. Patching closes the door. It does not remove whoever is already inside.