JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution
CVE-2026-63077
Verified
Description
JetBrains TeamCity < 2026.1.3, 2025.11.7 contains a remote code execution caused by unsafe XStream deserialization in the unauthenticated agent polling protocol. The XStream instance serving /app/agents/v1 is created without NoTypePermission.NONE, so XStream's default type permissions (Throwable, Map and Collection hierarchies) remain in effect next to the TeamCity allowlist. An unauthenticated attacker registers an agent, obtains a TeamCity-AgentSessionId, and posts an XStream XML object graph to /app/agents/v1/commands/error that makes TeamCity write an attacker-controlled file into the webroot. This template writes an arithmetic-canary JSP (no OS command execution) and matches its evaluated output.
Severity
Critical
CVSS Score
9.8
Exploit Probability
90%
Affected Product
teamcity
Published Date
August 7, 2026
Template Author
0x_akoko, pdteam
CVE-2026-63077.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-63077
CWE ID:
cwe-502
References
https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/https://www.rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/https://github.com/sfewer-r7/CVE-2026-63077https://nvd.nist.gov/vuln/detail/CVE-2026-63077https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077
Remediation Steps
Upgrade to TeamCity 2026.1.3, 2025.11.7 or later.