CriticalExploited in the wildCISA KEVPublic exploitVulnerability

CVE-2026-63077

Unauthenticated RCE in JetBrains TeamCity Agent Polling Protocol

Published Jul 27, 2026 · Updated 7 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

4 mentions · peak 2 in a dayToday

CVSS9.8Critical · v3.1

EPSS93.6%100th percentile

CISA KEVYesAdded Aug 5, 2026

In the wildActivePer CISA KEV

Vendor: Jetbrains

IdentifiersCVE-2026-63077CWE-502 · Deserialization of Untrusted Data

CVE-2026-63077 is an unsafe deserialization vulnerability in JetBrains TeamCity On-Premises releases preceding the applicable fixed versions 2025.11.7 and 2026.1.3. The agent polling protocol processes attacker-controlled XML through handleCommandIsFailedRequest(), Error.fromXml(), and XStreamWrapper.deserializeObject(). Vulnerable implementations apply a TeamCity class allowlist without first clearing XStream's default permissions, leaving broad type hierarchies, including Throwable and Map, eligible for deserialization. An unauthenticated remote attacker can obtain an agent polling session and submit a crafted object graph that triggers arbitrary operating system command execution with the privileges of the TeamCity server process. The vulnerability has a CVSS v3.1 score of 9.8 and has been exploited in the wild, including in ransomware campaigns.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can compromise the confidentiality, integrity, and availability of the TeamCity server and accessible CI/CD resources. Attackers may steal source code, stored credentials, signing material, cloud secrets, build configurations, and artifacts; modify build outputs or deployment pipelines; and move laterally into connected infrastructure. Compromised publishing or deployment credentials can extend the impact to downstream software consumers and production systems. Service disruption and ransomware deployment are possible, and ransomware campaign use has been confirmed.

Mitigation

If you can’t patch tonight, do this now.

If an immediate upgrade is impractical, install and enable JetBrains' security patch plugin for TeamCity 2017.1 and newer; this plugin addresses only CVE-2026-63077 and is not a substitute for broader security updates. Versions 2017.1 through 2018.1 require a server restart after installation, while versions 2018.2 and newer support activation without restarting. Remove unnecessary internet exposure, restrict HTTP(S) access to trusted networks and build agents, or require VPN access. Run the server with minimum necessary operating system privileges. Monitor for unexpected agent registrations, unauthorized administrator accounts or plugins, unusual command execution, and XStream deserialization exceptions. TeamCity Cloud tenants require no action because protective measures have already been applied.

Remediation

Patch, then assume compromise.

Upgrade TeamCity On-Premises to version 2025.11.7 or 2026.1.3, as appropriate for the release branch, or a later fixed release. The fix establishes deny-by-default XStream permissions using NoTypePermission.NONE before applying the approved class allowlist. Update all affected instances, including development, test, and backup environments. Patching does not remove an existing compromise: investigate exposed servers, preserve evidence when compromise is suspected, rotate potentially exposed credentials, tokens, keys, and certificates, and assess whether build artifacts or releases were altered.

Public exploits

Exploits

4 exploits validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.

View more in app →

CVE-2026-63077Repository contains a single Python proof-of-concept exploit and a README. The main file, CVE-2026-63077.py, targets JetBrains TeamCity CVE-2026-63077 and performs unauthenticated RCE through TeamCity agent polling functionality. The exploit flow is: generate randomized identifiers; build synthetic agent registration XML; register to /app/agents/v1/register; craft a malicious XStream gadget graph that instantiates an HSQLDB datasource and uses connectionInitSqls to create a table, insert a JSP scriptlet, and write it into the TeamCity webroot as a randomized .jspws file; submit that XML to /app/agents/v1/commands/error with TeamCity session headers; then request the dropped JSPWS path to execute the attacker-supplied OS command. The JSP payload is intentionally one-shot: it sets an application guard attribute, deletes its own source file, launches Runtime.exec(command), and prints a random token only if execution reaches that point. The README documents usage, expected output, and the underlying gadget chain. Overall, this is a real exploit PoC rather than a scanner: it provides direct command execution capability but does not include a reusable interactive shell framework or payload customization beyond the supplied command string.sfewer-r7 · Disclosed Aug 7, 2026 · python · markdown · web · networkOperational CVE-2026-63077Repository contains a Python proof-of-concept exploit (exploit.py) and a descriptive README. The exploit targets JetBrains TeamCity On-Premises CVE-2026-63077, described as an unauthenticated deserialization flaw in the agent polling protocol leading to remote code execution. The code is standalone Python using only the standard library, with exploit.py as the clear entry point. Core exploit flow: it generates random identifiers/tokens, builds an agent registration XML document with a spoofed agent address 127.0.0.1:9090, obtains a temporary TeamCity agent session, then submits a crafted XML payload to /app/agents/v1/commands/error. The payload appears designed to abuse server-side deserialization and HSQLDB scripting behavior to write a JSP file into a relative web root path ../webapps/ROOT/<random>.jspws. That JSP is a one-shot scriptlet that executes an attacker-supplied command via bash -c, returns stdout/stderr in the HTTP response, appends a response token for success detection, and attempts to delete itself after first execution. The exploit then requests the generated JSP path over HTTP(S), checks for the expected token in the response, strips HSQLDB-related wrapper text from output, and records successful command results to result.txt. The README documents single-target and multi-target usage, notes disabled TLS verification, and highlights operational limitations such as dependence on bash and the hard-coded web-root path. Overall, this is a real offensive PoC for unauthenticated network/web exploitation that provides arbitrary command execution rather than mere detection.AnggaTechI · Disclosed Aug 8, 2026 · python · markdown · network · webOperational CVE-2026-63077The repository contains one standalone Python 3 exploit (`CVE-2026-63077.py`) and a README. It claims to exploit CVE-2026-63077, an unauthenticated deserialization flaw in JetBrains TeamCity's agent-polling/error workflow. The script uses only Python standard-library modules and is not part of a known exploit framework. It generates random agent, database, table, column, JSP-file, guard, and response-token values; posts agent-registration XML; then posts a crafted serialized `linked-hash-map` payload intended to drive HSQLDB into writing a JSP scriptlet into the TeamCity webroot. Fetching the resulting randomized `.jspws` resource runs a supplied `bash -c` command and returns command output. The JSP contains a one-time application guard and self-deletes before execution. The tool supports individual targets, threaded target-list processing, output logging, payload debugging, and an interactive command loop. The README documents the intended chain and defaults; the displayed interactive-shell URL uses a placeholder (`xxxxxxxx.jspws`) even though actual payload filenames are randomized.0xCyp1337 · Disclosed Sep 4, 2026 · python · java · networkOperational B63-POC-CVE-2026-63077The supplied repository contains two standalone Python exploit drivers, a Python lab-startup helper, Docker Compose configuration, two database configuration files, seven evidence transcripts, and README/license/gitignore files. The three executable Python files use standard-library networking; the exploit payload embeds XML, SQL, and JSP/Java. The named authoring tooling does not establish integration with a recognized exploit framework. Both drivers implement the same unauthenticated registration → malicious error report → webshell execution chain. The reported flaw is an XStream allowlist that retains permissive default permissions because NoTypePermission.NONE was not installed first. Reconstructed objects trigger a JDBC connection, HSQLDB initialization SQL, and a SCRIPT-based file write into the webroot. Jasper then executes the resulting .jspws polyglot. The optimized variant uses three requests over one keep-alive connection and validates success through randomized output markers. The readable variant performs an additional id probe before executing the requested command. Both offer a persistent HTTP command channel rather than a reverse shell; no webshell cleanup is shown in the supplied excerpts. The loopback-only Compose lab pins vulnerable and patched vendor images by digest, exposes ports 8111 and 8112, and pre-seeds internal-HSQLDB configuration. The startup helper advances maintenance screens without creating an administrator account, with optional authenticated database recreation. Supplied transcripts report 10/10 successful runs for each variant against 2026.1.2 and 0/5 successful runs for each against 2026.1.3. They also show server-account execution and database-configuration retrieval. Documentation identifies 2026.1.3 and 2025.11.7 as fixed releases; only the former has supplied negative-test evidence. Useful detection signals include registration POSTs followed by XML to /app/agents/v1/commands/error containing linked-hash-map, HSQLMetadataStorage, TiedMapEntry, or connectionInitSqls; unexpected .jspws files and Jasper compilation activity; and ConversionException traces involving BasicDataSource. The supplied patched traces instead show ForbiddenClassException for the gadget class. These are repository-provided claims and transcripts, not independently executed verification. README and exploit bodies are partly truncated. No repository URL, Git reference, or archive size was provided; empty strings and size 0 represent unavailable metadata.basesixtythree · Disclosed Oct 22, 2026 · python · java · network · webOperational

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

JetbrainsTeamcityapplication

External references

References

MITRE CVEcve.org · CVE-2026-63077 NVDnvd.nist.gov/vuln/detail/CVE-2026-63077 MITRE CWE · CWE-502Deserialization of Untrusted Data Vendor Advisoryjetbrains.com/privacy-security/issues-fixed US Government Resourcecisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077

Activity feed

Recent activity

324 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

scworldNews · Sep 24, 2026Critical 9.8 JetBrains TeamCity RCE exploited by ransomware, says CISA | news | SC MediaA critical, unauthenticated remote code execution vulnerability in JetBrains TeamCity's agent polling protocol. Its compromise can expose build credentials and signing material, permit build-server manipulation, and enable malicious alteration of downstream build artifacts and CI/CD pipelines.Read more ↗cysecurity newsNews · Sep 8, 2026Attackers Exploit TeamCity Flaw to Breach JetBrains Cadence - CySecurity News - Latest Information Security and Hacking IncidentsA critical unauthenticated remote operating-system-command-execution vulnerability in JetBrains TeamCity On-Premises. The content reports exploitation against JetBrains' unpatched Cadence-related TeamCity infrastructure, resulting in exposure of a 2024 server backup, credentials, source code, and cloud-development service information.Read more ↗the hacker newsNews · Sep 5, 2026Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS CredentialsA critical CVSS 9.8 deserialization-of-untrusted-data vulnerability in JetBrains TeamCity that allows unauthenticated authentication bypass and arbitrary operating-system command execution as the TeamCity server process. It was exploited to compromise JetBrains Cadence infrastructure and potentially expose Cadence user data, source code, and credentials.Read more ↗nuclei templates pull requestsNews · Sep 1, 2026Fix CVE-2026-63077.yaml - retarget the agent polling protocol (/app/agents/v1) with the documented XStream XML gadget; legacy /app/agents/ probes never fire on affected builds by Dishant4081 · Pull Request #17045 · projectdiscovery/nuclei-templates · GitHubA critical insecure Java deserialization vulnerability in JetBrains TeamCity Server's agent command/error-processing endpoint. The supplied example uses an XStream deserialization path and Java gadget chain to achieve remote code execution, evidenced by deployment and retrieval of a .jspws server-side web shell.Read more ↗

+15 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signatures1YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity176Community discussion across Reddit, Mastodon, and other social sources.