TeamCity CVE-2026-63077: Unauthenticated Deserialization RCE in Agent Polling Actively Exploited

TeamCity CVE-2026-63077: Unauthenticated Deserialization RCE in Agent Polling Actively Exploited 1. Basic Information - Article Title: Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability - Publisher: SecurityWeek - Publication Date: August 6, 2026 - Original Source: SecurityWeek - Primary Source: JetBrains advisory / CISA KEV - Related CVE & Product: CVE-2026-63077, JetBrains TeamCity On-Premises, agent polling protocol - Fixed Versions: 2025.11.7, 2026.1.3. Security patch plugin is available for version 2017.1 and later. - Severity: Critical 2. Executive Summary This is an actively exploited RCE vulnerability. Attackers send unauthenticated and crafted serialized data to the TeamCity agent polling protocol via HTTP(S). This allows them to execute OS commands with TeamCity server process privileges, leading to the compromise of build secrets, artifacts, and downstream pipelines. 3. Attack Flow Confirmed Vulnerability Chain - Discover the TeamCity server from the internet or an untrusted network. - Send a crafted payload to the agent polling protocol endpoint. - Bypass the authentication check and trigger the deserialization of untrusted data. - Execute arbitrary OS commands with TeamCity server process privileges. - Gain access to TeamCity configurations, credentials, projects, and artifacts. Post-Exploitation Chain (Inference) - Search for VCS tokens, artifact repositories, cloud/deploy keys, and signing materials. - Modify build configurations, plugins, and artifacts. - Move laterally to build agents or downstream deployment environments. - Escalate to supply-chain distribution, data theft, or ransomware. 4. Attacker Position and Execution Location - The attacker is on an external or internal network that can reach TeamCity HTTP(S). - The exploit process runs on the TeamCity server, and commands run under the OS user of the server process. - If build agent isolation is weak, the attack can expand to the CI/CD network and deployment targets. 5. Visibility for Victims and Administrators User actions or successful logins are not required. WAFs or reverse proxies can see abnormal requests to agent polling. EDR can see shells, download tools, and credential access originating from the TeamCity Java process. Because this uses the same protocol as normal agent traffic, analysts must correlate the source, payload size, failure rate, and child processes. 6. Success and Failure Conditions Success Conditions - HTTP(S) reachability to an affected TeamCity On-Premises server. - Version is older than 2025.11.7/2026.1.3, or the patch plugin is not applied. - The TeamCity process has broad privileges to secrets and the network. Failure Conditions - Update to version 2025.11.7 or 2026.1.3. - Apply the security patch plugin for version 2017.1 or later. - Restrict access to trusted networks using a VPN or reverse proxy allowlist. - Run the server with least privilege and on a separate host from the agents. 7. What Happens on Success TeamCity server takeover compromises sources, configurations, stored credentials, and artifact integrity. Attackers may use CI/CD trust paths to distribute malicious artifacts or deployments. 8. Observable Logs - Email: Not an initial vector. Unprocessed TeamCity security/update notifications. - Proxy/SWG/DNS: Unknown sources targeting agent polling endpoints, and payload/C2 egress after the exploit. - Endpoint/EDR: TeamCity/Java -> shell, PowerShell/curl/wget, credential/config reads, plugin/artifact modifications. - Identity/IdP: Execution without login. Subsequent use of VCS/cloud/service accounts. - SaaS/Cloud: Abnormal use of Git hosting, artifact registries, cloud deployments, and CI secrets. - Network: External polling requests, and out-of-the-ordinary connections from the server to build agents or internal services. 9. Attack Success Determination - Contact Only: Version fingerprint, polling probes. - User Action: None required. - Initial Execution: Deserialization side effects, TeamCity child processes. - Malware/Authentication Success: Payload download, shell, new processes/files. - Data Theft/Session Compromise: Reading and external use of TeamCity/VCS/cloud credentials. - Subsequent Compromise Confirmation: Build/plugin/artifact tampering, agent connections, downstream deployments. 10. Investigation Playbook - Trigger: KEV target version, external polling, TeamCity child shells, artifact/config changes. - Initial Verification: Identify the version, plugins, exposure, initial malicious requests, and processes. - Endpoints: Preserve processes, files, plugins, artifacts, services, and egress logs on servers and agents. - Authentication & Cloud: Inventory and revoke VCS, registry, signing, cloud, and deployment credentials. - Subsequent Actions: Compare build history, artifact hashes, pipeline changes, agent tasks, and deployment targets. - Containment: Isolate, patch, rebuild the server, rotate credentials, and regenerate/resign artifacts. - Severity Classification: Vulnerable / Probe / Exploit Attempt / RCE / Secret Theft / Build Tamper / Downstream Compromise. 11. Defense and Detection Ideas - Single Event: Polling from untrusted sources, TeamCity Java child shells, new executables/plugins on the server. - Time-Series Correlation: Polling request -> Java deserialization -> shell -> secret read -> artifact/config change -> agent/deploy. - Hunting: Access logs before and after updates, TeamCity process trees, unknown builds, artifact hash differences, token usage. - Log Gaps: Request bodies, agent protocol metadata, process command lines, secret access, artifact provenance. - Priority Actions: Update immediately, stop external exposure, separate servers and agents, rotate secrets, verify artifact integrity. 12. Facts / Inference / Hypothesis Facts - All TeamCity On-Premises versions are affected, while Cloud versions are already secured. - Unauthenticated HTTP(S) callers can execute OS commands via the agent polling protocol. - Fixed versions are 2025.11.7/2026.1.3, and a plugin is available for version 2017.1 and later. - At the time of JetBrains' disclosure, the vulnerability was not exploited, but CISA later confirmed active exploitation. Inference - When RCE is confirmed, not only TeamCity credentials but also secrets injected into past builds must be rotated. - Even if artifact hashes are normal, if signing credentials were stolen, the trust chain must be verified separately. Hypothesis - After internet scans, attackers may choose cryptominers, ransomware, or supply-chain access depending on the victim environment. 13. MITRE ATT&CK Mapping - High Confidence: T1190 Exploit Public-Facing Application, T1059 Command and Scripting Interpreter - Medium Confidence: T1552 Unsecured Credentials, T1528 Steal Application Access Token, T1554 Compromise Client Software Binary, T1505 Server Software Component, T1021 Remote Services, T1105 Ingress Tool Transfer 14. Unknowns and Additional Investigation - IOCs, payloads, threat actors, and timelines observed by CISA. - Stable network signatures for exploit requests. - Public instances and actual damage in local regions. - Actual impact on artifacts, sources, and signing keys. 15. Impact on SOCs and General Enterprises TeamCity sits at the boundary between development networks and production deployments. Enterprises must check reachability via VPNs, partner networks, and cloud load balancers-not just direct public exposure. They must apply patches and retroactively verify secrets and artifacts at the same time. 16. Summary by Target Audience - For SOCs: Correlate polling requests, Java child processes, and secret/artifact changes. Look back to the date before the disclosure. - For Administrators: Update to version 2025.11.7/2026.1.3. If not possible, apply the plugin, restrict network access, and separate servers from agents. - For Users: This is a server attack that requires no user action. Follow instructions for rebuilding projects and changing credentials. Top comments (0)