Full research report
Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
Executive assessment
CVE-2026-63077 represents a high-severity CI/CD supply-chain risk: an unauthenticated attacker with network access to a TeamCity On-Premises server can execute arbitrary operating system commands by exploiting a misconfigured XStream deserialization allowlist in the agent polling protocol. JetBrains disclosed and patched the vulnerability on 27 July 2026, but CISA confirmed active exploitation just nine days later, with a compressed three-day federal remediation deadline signalling high-confidence real-world risk. Rapid7's detailed technical write-up documents the gadget chain and JSP-based payload delivery mechanism, indicating the vulnerability is reliably exploitable by a capable attacker, and approximately 4,500 internet-exposed instances were identified at disclosure. No threat actor has been publicly attributed to the observed exploitation, leaving the scope and targeting of the campaign unknown; defenders should treat any unpatched, internet-exposed TeamCity instance as potentially compromised and prioritise both patching and retrospective review of stored credentials and build artefacts.
What happened
On 27 July 2026, JetBrains published a security advisory for CVE-2026-63077, a critical unsafe deserialization vulnerability (CVSS 9.8, CWE-502) in TeamCity On-Premises, reported by researcher Antoni Tremblay on 10 July 2026. The vulnerability affects all TeamCity On-Premises versions prior to 2025.11.7 and 2026.1.3 and permits unauthenticated remote code execution via the agent polling protocol over HTTP or HTTPS. Within nine days of public disclosure, CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 5 August 2026, confirming real-world exploitation and mandating federal agency patching by 8 August 2026. JetBrains subsequently issued an updated advisory confirming receipt of active exploitation reports and publishing defender indicators of compromise.
Affected scope
All JetBrains TeamCity On-Premises versions prior to 2025.11.7 (2025.11.x branch) and 2026.1.3 (2026.x branch). A security patch plugin is available for instances running version 2017.1 and later. TeamCity Cloud is unaffected. Censys identified approximately 4,500 TeamCity web properties directly reachable from the internet at the time of disclosure.
Technical assessment
The vulnerability resides in TeamCity's XStream configuration for the agent polling protocol. The server creates an XStream allowlist intended to restrict which Java classes may be deserialised when servicing unauthenticated agent requests, but fails to clear XStream's default class permissions before applying the protocol-specific allowlist. This permits an unauthenticated attacker to submit a crafted serialised payload to agent polling endpoints, triggering a deserialization gadget chain that achieves arbitrary operating system command execution with the privileges of the TeamCity server process. Successful exploitation enables an attacker to read stored credentials, modify build configurations, and compromise CI/CD research process integrity or inject malicious build artefacts. Rapid7's analysis documents the specific gadget chain and a JSP-based payload delivery mechanism, indicating the vulnerability is straightforwardly exploitable by a capable attacker.
Recommended defensive actions
- Upgrade all TeamCity On-Premises instances to version 2025.11.7 or 2026.1.3 immediately; federal agencies were required to complete this by 8 August 2026.
- Apply the JetBrains security patch plugin as a temporary measure on any instance running version 2017.1 or later that cannot be immediately upgraded; versions 2017.1–2018.1 require a server restart after installation.
- Restrict network access to TeamCity servers to trusted internal networks and block unauthenticated inbound HTTP/HTTPS from untrusted sources as an interim mitigation where patching is not yet complete.
- Hunt for IOCs in TeamCity server logs: search for POST requests to agent polling endpoints, XStream `ForbiddenClassException` or `ConversionException` stack traces, and build agents registering with names beginning with `scan`.
- Audit all build pipelines, stored credentials and build artefacts on any TeamCity instance that was internet-exposed before patching, treating them as potentially compromised.
Uncertainties and evidence gaps
- No specific threat actor, ransomware group or campaign has been publicly attributed to the observed exploitation as of 8 August 2026.
- The precise nature, scale and targets of active exploitation are not publicly documented; CISA confirmed exploitation in the wild but has not published specific incident details.
- It is unknown whether exploitation has been limited to opportunistic scanning or whether targeted attacks against specific organisations or sectors have occurred.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Confirmed active exploitation in the wild; CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalogue on 5 August 2026 with a three-day federal remediation deadline of 8 August 2026.
The investigation began with a clearly framed primary source claim — an unauthenticated RCE in JetBrains TeamCity with a confirmed CISA KEV entry. I fetched both Rapid7 publications and both JetBrains advisories to establish the technical basis, timeline and remediation options, then corroborated exploitation status via NVD and independent reporting from SecurityWeek and The Hacker News. Searches for threat actor attribution and dark-web chatter returned nothing attributable. A GitHub PoC repository mentioned in one source could not be confirmed to exist on the researcher's public profile.
- What are the technical details and affected scope of CVE-2026-63077?Searched for CVE-2026-63077 JetBrains TeamCity unauthenticated RCE deserialization 2026.
Critical (CVSS 9.8) unsafe deserialization in the agent polling protocol; affects all TeamCity On-Premises before 2025.11.7 and 2026.1.3; XStream allowlist misconfiguration enables unauthenticated code execution; CISA KEV confirmed.
why Established core technical claim and affected scope from multiple source snippets, confirming this is a well-evidenced vulnerability warranting deeper investigation.
- What does the Rapid7 technical analysis reveal about the exploitation mechanism and IOCs?Fetched the Rapid7 detailed analysis blog post.rapid7.com ↗
Gadget chain uses BasicDataSource, FreeMarker and HSQLDB; malicious JSP payload written to webroot; attack proceeds via agent polling endpoints; IOCs include XStream exception log entries; fixed version patches the allowlist by inserting `NoTypePermission.NONE` before the allowlist.
why Provided the non-weaponisable technical mechanism and IOC detail needed to populate the vulnerability_flow and detection fields with sourced, concrete information.
- What does the Rapid7 Emergent Threat Response add to the timeline and remediation picture?Fetched the Rapid7 ETR blog post.rapid7.com ↗
ETR published 29 July 2026; confirms affected version range, remediation options, and notes JetBrains initially reported no known active exploitation at disclosure.
why Established the pre-exploitation window and the gap between disclosure and confirmed exploitation, important for scoping the risk timeline.
- What is the official JetBrains vendor advisory timeline and what mitigations are available?Fetched the JetBrains original advisory and the August 2026 follow-up update.blog.jetbrains.com ↗
Vulnerability reported 10 July 2026 by Antoni Tremblay; advisory published 27 July 2026; fixed in 2025.11.7 and 2026.1.3; patch plugin available for 2017.1+; August update confirmed exploitation reports and added IOCs including agent names beginning with `scan`.
why Vendor advisories are the authoritative source for remediation guidance, reporter attribution and IOCs; the August update upgraded the exploitation assessment from 'no known exploitation' to 'confirmed reports'.
- Does NVD corroborate the CVE details and CISA KEV status?Fetched the NVD CVE detail page for CVE-2026-63077.nvd.nist.gov ↗
NVD confirms CVSS 9.8, CWE-502, affected versions (before 2025.11.7 and 2026.1.3), and CISA KEV listing with 8 August 2026 remediation deadline.
why NVD provides independent government-sourced corroboration of the CVE details and CISA KEV entry, meeting the requirement for at least two independent source domains.
- What do independent security outlets report about exploitation and internet exposure?Fetched SecurityWeek and The Hacker News articles on the exploitation reports.securityweek.com ↗
SecurityWeek reports approximately 4,500 internet-exposed TeamCity servers; notes no public information on attack specifics or actor identity; The Hacker News confirms CISA KEV and federal deadline with no attribution available.
why Independent corroboration from two additional domains confirms exploitation status and quantifies the exposed attack surface without requiring reliance on vendor or Rapid7 sources alone.
- Is a public PoC exploit repository confirmed to exist?Searched for sfewer-r7 CVE-2026-63077 GitHub repository and fetched the sfewer-r7 GitHub profile.github.com ↗
No repository named CVE-2026-63077 is visible on the researcher's public GitHub profile; the profile displays other CVE-named repositories for different vulnerabilities but not this one.
why Could not confirm a standalone public PoC repository; the Rapid7 blog write-up is the primary technical reference. Citing an unverified URL was avoided.
Research coverage
All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 55 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1662 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| Rapid7news | ok1 records | Primary evidence3 matched items | Published the source report used to frame and date the event. Supplied a vendor or government advisory opened and verified during focused research. Supplied a PoC or technical exploit reference opened and verified during focused research. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok7541 records | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok5 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5322 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok676 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1008 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok18 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok5 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 5 opened outside the registered collection
Vulnerability & exploitation2
Reporting-linked PoC claims1
Linked by reporting but not validated as PoC by the configured exploit indexes.
Technical references1
Repository captured from the source article as technical context; not validated as PoC or exploit code.
PoC & exploit code1
Full technical write-up covering root cause, gadget chain, JSP payload execution and defender IOCs.
Vendor & gov advisories4
Original vendor advisory published 27 July 2026; identifies fixed versions and patch plugin availability.
Vendor follow-up confirming active exploitation reports and publishing IOCs including suspicious agent name patterns.
NIST record confirming CVSS 9.8, CWE-502, affected versions and CISA KEV listing with 8 August 2026 remediation deadline.
Rapid7 initial ETR published 29 July 2026 with remediation guidance and internet exposure context.
Analysis & research2
Independent reporting noting approximately 4,500 internet-exposed TeamCity servers; confirms CISA KEV addition with no actor attribution.
Corroborates CISA KEV confirmation and federal patching deadline; notes no public disclosure of specific attack techniques or targets.