Listen to this Post
CVE-2026-63077 is a critical unauthenticated remote code execution vulnerability impacting JetBrains TeamCity On-Premises environments. The security flaw stems from unsafe object deserialization handled by the agent polling protocol endpoint. Unauthenticated attackers with network access can reach this endpoint and transmit maliciously crafted payload data without requiring valid credentials. Because the endpoint processes incoming streams without proper validation, it triggers a vulnerable XStream deserialization process. The attack vector leverages a specific gadget chain involving Apache Commons DBCP and HSQLDB drivers. By forcing the system to instantiate a BasicDataSource object and invoke database connection methods, the payload executes custom initialization SQL statements. This mechanism functions as a polyglot, writing a malicious JavaServer Pages (JSP) file directly into the server’s webroot directory. Once the JSP file is written, an HTTP request to the dropped script executes arbitrary operating system commands with the privileges of the TeamCity service account. This bypasses all authentication boundaries, letting malicious actors completely compromise the CI/CD pipeline, manipulate build configurations, and access stored version control credentials. CISA subsequently added the vulnerability to its Known Exploited Vulnerabilities catalog following active exploitation observations in the wild. Remediation requires updating the software or applying official vendor patches immediately.
DailyCVE Form:
Platform: JetBrains TeamCity Server
Version: Below 2026.1.3
Vulnerability: Unauthenticated remote code
Severity: Critical severity
date: July 2026
Prediction: Already officially patched
What Undercode Say:
Analytics and observations regarding the deserialization vector emphasize that protocol endpoints lacking pre-authentication checks represent severe security risks in enterprise software. Code inspection of the agent polling mechanism revealed insufficient type validation during object mapping.
Example curl probe checking TeamCity endpoint reachability curl -ik https://target-teamcity-server:8111/app/rest/server
Exploit: (Educational Purposes!)
// Conceptual XStream gadget chain snippet targeting TeamCity polling protocol XStream xstream = new XStream(); String payload = "<map><entry><org.apache.commons.dbcp2.BasicDataSource>...</org.apache.commons.dbcp2.BasicDataSource></entry></map>"; xstream.fromXML(payload);
Protection: from this CVE
Upgrade JetBrains TeamCity On-Premises to version 2026.1.3 or 2025.11.7 immediately, or install the official JetBrains security patch plugin. Restrict network access to the TeamCity server and isolate build agent subnets to prevent unauthorized exposure.
Impact:
Complete system compromise of the TeamCity server, execution of arbitrary OS commands with service account privileges, unauthorized access to source code repositories, tampering with build pipelines, leakage of stored credentials, and potential supply chain contamination across downstream software deployments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
