In JetBrains TeamCity before 2026.1.3

CVE-2026-63077 is an unauthenticated remote code execution vulnerability in the agent polling protocol of all JetBrains TeamCity On-Premises versions prior to 2026.1.3 and 2025.11.7. The root cause is classic insecure deserialization (CWE-502): the server-side endpoint that build agents poll for work accepts serialized objects over HTTP(S) without verifying the caller's identity. An attacker who can reach the TeamCity web port sends a crafted payload to this endpoint and achieves arbitrary OS command execution under the TeamCity server process account — no credentials, no user interaction, no prior access required. Impact is total: source code, build secrets, environment variables, deployment keys, and the ability to inject malicious code into every downstream artifact.

JetBrains rated this CVSS 9.8 CRITICAL and noisgate agrees without reservation. The vendor severity is not inflated — it may even understate the strategic risk. TeamCity On-Premises is, by definition, a CI/CD build server. Every single installation sits squarely in the high-value-role catalog for supply-chain infrastructure. APT29 (CozyBear / SVR) exploited the prior TeamCity auth-bypass (CVE-2023-42793) at scale in late 2023 for exactly this class of supply-chain pivot, and CISA issued a joint advisory with NSA and FBI. The absence of a public PoC and in-the-wild exploitation *today* is a countdown timer, not a mitigant — deserialization bugs in Java-based CI/CD platforms have a track record of weaponization within days to weeks of disclosure.

Why this verdict

• Unauthenticated, zero-friction entry: The CVSS vector PR:N/UI:N/AC:L means any attacker with network access to the TeamCity HTTP port can exploit this with no credentials, no user interaction, and no race conditions. There is no authentication friction to discount.
• All versions affected — maximum exposure window: Every TeamCity On-Premises installation ever deployed is vulnerable unless already updated to the July 27 release. The security patch plugin extends coverage back to 2017.1, but organizations must actively install it. The affected population is the entire On-Premises install base.
• Role multiplier: CI/CD build server = supply-chain-scale blast radius. TeamCity On-Premises IS the CI/CD platform — 100% of installs occupy the high-value role by definition. Compromise yields stored credentials (VCS, cloud, registry tokens), the ability to inject malicious code into build pipelines, and lateral movement into production infrastructure. This is the SolarWinds attack pattern, and APT29 has already executed it against TeamCity via CVE-2023-42793.
• APT29 operational precedent: Russian SVR actors exploited the prior TeamCity RCE (CVE-2023-42793) at scale within weeks of disclosure, targeting technology companies for supply-chain access. CISA, NSA, and FBI issued a joint advisory. The same threat actor will almost certainly evaluate this new vulnerability for the same operational objective.
• Internet exposure is non-trivial: ~2,200+ TeamCity instances are directly internet-facing per historical Shodan data. But even internally-accessible TeamCity servers are high-value targets for any attacker with internal network access (post-phishing, post-VPN compromise). The 'requires network access' prerequisite provides minimal friction in practice.
• Role multiplier detail — high-value role analysis: (a) *Low-value role:* N/A — TeamCity does not deploy as a workstation or sandbox component. (b) *Typical role:* standalone CI/CD server for a dev team — compromise yields that team's source, secrets, and artifacts. (c) *High-value role:* enterprise CI/CD platform building production software, container images, or customer-facing releases — compromise yields supply-chain pivot. ≥10% of installs (arguably the majority) serve production CI/CD, placing the verdict floor at CRITICAL per noisgate policy.

Why not higher?

CVSS 9.8 is already near-maximum. A 10.0 would require Scope:Changed, meaning the vulnerability breaks out of its security boundary to affect other components' authorization. While the supply-chain impact is devastating, the CVSS base score accurately reflects the server-scoped impact. The reassessed score stays at 9.8 — there is no higher to go within the CRITICAL band for this vector.

Why not lower?

Downgrading would require friction that materially reduces the reachable population or blast radius. There is none: authentication is absent, all versions are affected, the agent polling endpoint sits on the same port as the web UI (no separate port to firewall), and the affected component is definitionally a CI/CD server with supply-chain blast radius. The absence of a public PoC is a temporary condition, not a structural mitigant — deserialization bugs in Java CI platforms are a solved engineering problem for offensive researchers. Prior TeamCity CVEs went from disclosure to mass exploitation in under two weeks.

1. Restrict network access to TeamCity to trusted build agent IPs and admin workstations only — The agent polling endpoint sits on the same HTTP(S) port as the web UI. Use host firewall rules (iptables/Windows Firewall) or network ACLs to whitelist only known build agent IPs and authorized administrator source IPs. This is the single highest-impact compensating control — it eliminates the unauthenticated remote attack vector for all non-whitelisted sources. Deploy within 3 days per noisgate CRITICAL mitigation SLA.
2. Install the JetBrains security patch plugin immediately if full upgrade is not feasible — Download fix_CVE_2026_63077.zip from the JetBrains site and install via Administration → Plugins. TeamCity 2018.2+ activates without restart; 2017.1–2018.1 requires a restart. This patches the specific deserialization flaw without a full version upgrade. Deploy within 3 days per noisgate CRITICAL mitigation SLA.
3. Place TeamCity behind a reverse proxy or VPN with authentication — If TeamCity must be reachable beyond the local subnet, front it with a reverse proxy (nginx, HAProxy) that requires client certificate or SSO authentication before traffic reaches TeamCity. Alternatively, require VPN access. This adds an authentication layer the vulnerability itself lacks.
4. Deploy or tune EDR to alert on child processes from the TeamCity Java process — Create detection rules for cmd.exe, powershell.exe, bash, sh, curl, wget, or certutil spawned by the TeamCity wrapper or java.exe running as the TeamCity service. This provides post-exploitation detection if network controls fail.
5. Rotate all credentials stored in TeamCity after patching — Assume stored secrets (VCS tokens, deployment keys, cloud credentials, registry passwords) may be compromised. After patching, rotate every credential referenced in TeamCity project configurations, build parameters, and environment variables. Audit cloud and VCS audit logs for unauthorized use of TeamCity service accounts.
6. Audit TeamCity build configurations for unauthorized modifications — Review all build step definitions, meta-runners, and plugins for injected malicious commands. Compare current configurations against version-controlled baselines (if TeamCity configs are stored as Kotlin DSL in VCS). Check the TeamCity audit log for configuration changes from unexpected sources or times.

Run this script on the TeamCity server host (Linux) as any user with read access to the TeamCity installation directory. Example: chmod +x check_cve_2026_63077.sh && ./check_cve_2026_63077.sh /opt/TeamCity. No root required unless the TeamCity installation directory has restrictive permissions.

#!/bin/bash
# check_cve_2026_63077.sh — Detect CVE-2026-63077 vulnerability in TeamCity On-Premises
# Usage: ./check_cve_2026_63077.sh [TEAMCITY_HOME]
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

TC_HOME="${1:-/opt/TeamCity}"
VERSION_FILE="$TC_HOME/webapps/ROOT/WEB-INF/PluginData/info/teamcity-version.xml"
PLUGIN_DIR="$TC_HOME/webapps/ROOT/WEB-INF/plugins"
PATCH_PLUGIN="fix_CVE_2026_63077"

if [ ! -f "$VERSION_FILE" ]; then
  # Try alternative location
  VERSION_FILE="$TC_HOME/BuildServer/config/internal/version.dat"
fi

if [ ! -f "$VERSION_FILE" ] && [ ! -d "$TC_HOME" ]; then
  echo "UNKNOWN — TeamCity installation not found at $TC_HOME"
  echo "Usage: $0 /path/to/TeamCity"
  exit 2
fi

# Try to extract version from TeamCity startup log or version file
VERSION=""
if [ -f "$TC_HOME/webapps/ROOT/WEB-INF/PluginData/info/teamcity-version.xml" ]; then
  VERSION=$(grep -oP 'version="\K[^"]+' "$TC_HOME/webapps/ROOT/WEB-INF/PluginData/info/teamcity-version.xml" 2>/dev/null | head -1)
elif [ -f "$TC_HOME/BUILD_*" ] || ls "$TC_HOME"/BUILD_* 1>/dev/null 2>&1; then
  VERSION=$(ls "$TC_HOME"/BUILD_* 2>/dev/null | head -1 | grep -oP 'BUILD_\K.*')
fi

# Fallback: check catalina logs for version string
if [ -z "$VERSION" ]; then
  for logfile in "$TC_HOME/logs/catalina.out" "$TC_HOME/logs/teamcity-server.log"; do
    if [ -f "$logfile" ]; then
      VERSION=$(grep -oP 'TeamCity server version is \K[0-9.]+' "$logfile" 2>/dev/null | tail -1)
      [ -n "$VERSION" ] && break
    fi
  done
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not determine TeamCity version at $TC_HOME"
  exit 2
fi

echo "Detected TeamCity version: $VERSION"

# Check if security patch plugin is installed
PATCH_INSTALLED=false
if [ -d "$PLUGIN_DIR" ]; then
  if ls "$PLUGIN_DIR"/ 2>/dev/null | grep -qi "$PATCH_PLUGIN"; then
    PATCH_INSTALLED=true
  fi
fi
# Also check external plugins directory
EXT_PLUGIN_DIR="$TC_HOME/../.BuildServer/plugins"
if [ -d "$EXT_PLUGIN_DIR" ]; then
  if ls "$EXT_PLUGIN_DIR"/ 2>/dev/null | grep -qi "$PATCH_PLUGIN"; then
    PATCH_INSTALLED=true
  fi
fi

# Version comparison function
version_gte() {
  printf '%s\n%s' "$2" "$1" | sort -V -C
}

# Determine if patched
# Fixed versions: 2026.1.3+ or 2025.11.7+
# Version format: YYYY.MM.PATCH or YYYY.X.PATCH
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

if [ "$MAJOR" -gt 2026 ] 2>/dev/null; then
  echo "PATCHED — TeamCity $VERSION is newer than the affected range."
  exit 0
elif [ "$MAJOR" -eq 2026 ] 2>/dev/null; then
  if version_gte "$VERSION" "2026.1.3"; then
    echo "PATCHED — TeamCity $VERSION includes the fix for CVE-2026-63077."
    exit 0
  fi
elif [ "$MAJOR" -eq 2025 ] 2>/dev/null; then
  if [ "$MINOR" -eq 11 ] 2>/dev/null && version_gte "$VERSION" "2025.11.7"; then
    echo "PATCHED — TeamCity $VERSION includes the fix for CVE-2026-63077."
    exit 0
  elif [ "$MINOR" -gt 11 ] 2>/dev/null; then
    # 2025.12+ would be covered by 2026.x branch
    echo "UNKNOWN — Unexpected version $VERSION. Verify manually."
    exit 2
  fi
fi

# If we reach here, version is vulnerable — check for patch plugin
if [ "$PATCH_INSTALLED" = true ]; then
  echo "PATCHED — TeamCity $VERSION is vulnerable but security patch plugin ($PATCH_PLUGIN) is installed."
  exit 0
fi

echo "VULNERABLE — TeamCity $VERSION is affected by CVE-2026-63077. No security patch plugin detected."
echo "Action required: Upgrade to 2026.1.3 / 2025.11.7 or install the security patch plugin."
exit 1

Sources

1. JetBrains Official Advisory
2. Rapid7 Emergent Threat Response
3. Help Net Security Coverage
4. The Hacker News Coverage
5. IONIX Threat Center
6. CISA/NSA/FBI Joint Advisory on APT29 TeamCity Exploitation (CVE-2023-42793)
7. Security Affairs Coverage
8. Cybersecurity News Coverage