CVE-2026-63077 is a critical Remote Code Execution (RCE) vulnerability in JetBrains TeamCity On-Premises that allows unauthenticated attackers to bypass authentication via HTTP(S) and execute arbitrary operating system commands.
This flaw stems from the uncontrolled deserialization of untrusted data (CWE-502) within the Agent Polling protocol. If successfully exploited, an attacker gains the same privileges as the TeamCity server process, which can lead to the exposure of internal data, stored credentials, and unauthorized server modifications.
As TeamCity is a core CI/CD platform, this vulnerability poses a severe threat to software supply chain security. A successful attack could potentially allow threat actors to steal source code, manipulate build artifacts, and compromise the integrity of downstream CI/CD pipelines.
Tags: jetbrains, teamcity
---
1. Overview
CVE-2026-63077 is a critical remote code execution (RCE) vulnerability affecting JetBrains TeamCity On-Premises environments. An attacker targeting a vulnerable TeamCity server accessible via HTTP(S) can bypass the authentication process without separate authentication and execute arbitrary operating system commands.
This vulnerability arises from inadequate controls over the deserialization of untrusted data (CWE-502) in TeamCity’s Agent Polling protocol. A successful attack allows the execution of arbitrary operating system commands with the privileges of the TeamCity server process; depending on the permissions granted to that process, this could result in the exposure of internal TeamCity data, configuration information, and stored credentials, or the tampering of the server’s state.
In particular, since TeamCity is a CI/CD platform directly involved in the source code build and deployment processes, exploitation of this vulnerability could lead not only to the theft of source code and credentials but also to the tampering of build artifacts and the compromise of the integrity of downstream CI/CD pipelines, potentially causing serious impacts on software supply chain security.
Furthermore, as of August 2026, actual attacks and exploitation attempts targeting unpatched TeamCity servers have been confirmed, and CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
---
2. Cause
The root cause of this vulnerability lies in the incomplete configuration of the type allowlist in the XStream library, which serializes and deserializes Java objects into XML format.
Insecure Deserialization Handling:
TeamCity uses the XStream type allowlist to restrict the Java classes that can be deserialized when processing unauthenticated agent requests. However, in the vulnerable version, only TeamCity protocol-related classes were added NoTypePermission.NONEand instead only added classes related to the TeamCity protocol. As a result, XStream’s existing default permissions remained in effect alongside the allowlist defined by TeamCity.
Configurable Gadget Chain:
The remaining default XStream type permissions Map, Throwablepermissions that encompassed various implementation classes and subclasses, as shown above. An attacker could exploit this by combining methods and callbacks invoked during object creation and deserialization to construct a gadget chain that could lead to arbitrary code execution.
In the patched version, before configuring the deserialization allowlist, NoTypePermission.NONEto remove the existing permissions for primitive types and explicitly allow only the classes necessary for TeamCity’s operation.
---
3. Key Attack Process
The attack flow exploiting CVE-2026-63077 proceeds as follows:
1- Initial Access and Agent Protocol Exploitation:
The attacker sends a request to the Agent Polling protocol endpoint of an externally accessible TeamCity server via HTTP or HTTPS. During this process, TeamCity-AgentSessionId the attacker manipulates the request—including agent communication information—to gain unauthenticated access to the vulnerable deserialization processing path.
2- Transmission of Malicious XML Payload:
The attacker sends a specially crafted XML payload via a POST request to trigger a gadget chain during the XStream deserialization process. In the disclosed attack technique, the attacker combines the Apache DBCP BasicDataSource, FreeMarker, and the HSQLDB driver included in TeamCity to construct the gadget chain.
3- Executing the Gadget Chain and Generating a JSP File:
During the deserialization of the malicious XML, this is invoked through access to FreeMarker’s object properties BasicDataSource.getConnection()is invoked. Subsequently, Apache DBCP creates an in-memory HSQLDB database configured by the attacker and connectionInitSqlsexecutes the SQL contained within it. Finally, by exploiting HSQLDB’s SCRIPT can be exploited to create a malicious JSP file in the TeamCity web root.
4- Remote Command Execution:
The attacker accesses the generated JSP file via a separate HTTP request. As the JSP runs on the server side, Runtime.getRuntime().exec() the attacker can use features such as to execute operating system commands specified by the attacker with TeamCity server process privileges.
These attacks can be carried out remotely and automatically without requiring user authentication or administrator interaction. Furthermore, since they are accessible over the network and have low attack complexity, there is a high likelihood of rapid exploitation for TeamCity servers exposed to the Internet following the disclosure of this vulnerability.
---
4. Impact
CVE-2026-63077 is a critical vulnerability rated 9.8 (Critical) under CVSS v3.1. It allows unauthenticated attacks over the network and enables the execution of arbitrary operating system commands with the privileges of the TeamCity server process without user interaction. Furthermore, its inclusion in the U.S. CISA’s Known Exploited Vulnerabilities (KEV) catalog on August 5, 2026, confirms that this vulnerability is currently being exploited in real-world environments.
In particular, since TeamCity is a CI/CD platform directly involved in the software build and deployment process, the risk is extremely high because a compromise could extend beyond a single server to affect the integrity of the entire development and deployment environment.
Gaining Control of the TeamCity Server:
An attacker can execute arbitrary operating system commands and alter the server’s state within the scope of privileges granted to the TeamCity server process. In environments where the server process is granted excessive privileges, the scope of the damage can be even greater.
Compromise of CI/CD Supply Chain Integrity:
If TeamCity’s build and deployment functions are compromised, build configurations or artifacts may be tampered with, affecting downstream CI/CD pipelines and undermining the reliability of the normal software deployment process.
Exposure of Confidential Information and Credentials:
Configuration information and various credentials stored in TeamCity may be exposed. Depending on the environment configuration, source repository access information, API keys, deployment accounts, and cloud-related credentials may be exploited in subsequent attacks.
This vulnerability has a network-based attack vector, low attack complexity, and does not require special privileges or user interaction. Accordingly, unpatched TeamCity servers exposed to the internet should be classified as high-risk assets requiring immediate inspection and remediation.
---
5. Mitigation Measures
CVE-2026-63077 is a high-risk vulnerability with confirmed real-world exploitation; applying security patches should be a top priority in affected TeamCity On-Premises environments. If applying the patch immediately is not feasible, the scope of attack exposure must be minimized by using the security plugin provided by JetBrains in conjunction with network access controls.
Security Patches and Upgrades:
As a top priority, TeamCity servers must be promptly updated to version 2025.11.7 or 2026.1.3 or later, where the vulnerability has been resolved. We recommend upgrading to the latest release version whenever possible to apply additional security patches as well.
Applying the Security Patch Plugin:
If an immediate version upgrade is not feasible, apply the official Security Patch Plugin provided by JetBrains. This plugin can be used as a temporary mitigation measure for CVE-2026-63077; however, you should prioritize upgrading to the official version whenever possible.
Network Access Control:
Restrict access so that the TeamCity server is not directly exposed to the internet, and configure firewall and ACL policies to allow access only via a VPN or a trusted internal network. In particular, for TeamCity servers exposed to the public, access policies should be reviewed as a priority to reduce the attack surface.
Web Application Firewall (WAF) Detection and Secondary Blocking:
In a WAF environment, monitor for abnormal requests entering TeamCity Agent Polling-related endpoints and XML-based deserialization attack patterns. TeamCity-AgentSessionIdTargets for detection can include repetitive abnormal requests, suspicious XML structures, and strings associated with gadget chains. However, since a web application firewall is a secondary defense mechanism, it must be used in conjunction with security patches to address the root cause.
Log Review and Breach Verification:
In TeamCity server logs, com.thoughtworks.xstream.converters.ConversionException, com.thoughtworks.xstream.security.ForbiddenClassException for exceptions related to the deserialization process. If suspicious requests or evidence of abnormal JSP file creation are found, further breach analysis must be conducted.
Least Privilege and Server Segregation:
Run the TeamCity server process with the minimum operating system privileges required for normal operation, and segregate the TeamCity server and build agents onto separate systems whenever possible to minimize the scope of damage in the event of a breach.
---
6. Conclusion
CVE-2026-63077 is a critical vulnerability that allows remote execution of arbitrary operating system commands without authentication; since it is already being exploited in real-world attacks, a swift response is required. In particular, since TeamCity is a CI/CD platform directly involved in the software build and deployment process, exploitation of this vulnerability could extend beyond a single server compromise to affect the entire software supply chain—including credential leaks, tampering with build artifacts, and compromising the integrity of downstream CI/CD pipelines.
Therefore, organizations operating TeamCity On-Premises environments must promptly update to the latest version, which addresses the vulnerability, while also minimizing external exposure and implementing network access controls.
Analysis based on the publicly disclosed PoC attack syntax confirmed that some attack patterns can currently be detected and blocked using Web Shell-related detection patterns in web firewalls. However, to more accurately identify the attack characteristics of CVE-2026-63077 and enhance the detection scope for variant attacks, we are currently developing and validating dedicated detection patterns that reflect the characteristics of Agent Polling requests, malicious XML deserialization, and related gadget chains; these will be incorporated into regular pattern updates once validation is complete.
---
7. Reference
- https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/
- https://blog.jetbrains.com/teamcity/2026/08/cve-2026-63077-update/
- https://nvd.nist.gov/vuln/detail/CVE-2026-63077
- https://www.rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
