erroneo.us
Search all guides⌘K

Security Digest · Jul 27, 2026 · Vulnerability · CI/CD

TeamCity CVE-2026-63077: Unauthenticated RCE, Exploited

All TeamCity On-Premises versions before 2025.11.7/2026.1.3 allow unauthenticated RCE via agent polling. In KEV, ransomware use known. Patch now.

Published By erroneo.us Security Desk · Updated 3 min read6 sources

Our verdict

Act now

Any self-hosted TeamCity server below 2025.11.7 or 2026.1.3 that an attacker can reach over HTTP(S) can be taken over without credentials, and ransomware crews are using it; patch or apply the security patch plugin today, then check for intrusions.

Who must act: Everyone running TeamCity On-Premises older than 2025.11.7 or 2026.1.3 without JetBrains' security patch plugin, above all internet-facing servers.

Who can relax: TeamCity Cloud customers, whom JetBrains says need no action, and on-prem servers already on 2025.11.7, 2026.1.3 or later, or with the patch plugin installed.

Affected
TeamCity On-Premises, all versions before 2025.11.7 and 2026.1.3
Fixed in
TeamCity 2025.11.7
TeamCity 2026.1.3
Security patch plugin for TeamCity 2017.1 and later
CVSS
9.8 (v3.1, CNA)
EPSS
89.6% (percentile 99.8)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Upgrade TeamCity On-Premises to 2025.11.7 or 2026.1.3 (or later), or install the CVE-2026-63077 security patch plugin.
  2. If you cannot patch right away, cut off external access to the server.
  3. Search server logs for com.thoughtworks.xstream.converters.ConversionException and investigate any hits.
  4. Remove unexpected unauthorized build agents, especially ones whose names start with scan.
  5. If compromise is suspected, rotate every secret TeamCity stores (VCS tokens, cloud keys, deploy credentials) and verify recent build artifacts.
  6. Longer term: put TeamCity behind a VPN, run it with least privilege, and keep agents on separate hosts.

How to check if you are affected or compromised

  • grep teamcity-server.log and related logs for com.thoughtworks.xstream.converters.ConversionException (possible attempt or success).
  • After patching, ForbiddenClassException entries mean an attempt was blocked.
  • Check Agents > Unauthorized for unknown agents, particularly names beginning with scan; trust log timestamps, not the agent date.
  • Look for unexpected processes, users or outbound connections from the TeamCity server host.

What happened#

On July 27, 2026, JetBrains disclosed CVE-2026-63077, a critical flaw in TeamCity On-Premises. An unauthenticated attacker who can reach the server over HTTP(S) can abuse the TeamCity agent polling protocol to get past authentication checks and run operating system commands with the privileges of the TeamCity server process. The CVE record classifies it as deserialization of untrusted data (CWE-502) and scores it CVSS 3.1 9.8. JetBrains' later guidance points to XStream exceptions in the logs. Antoni Tremblay reported the bug privately on July 10.

When it disclosed the bug, JetBrains said it knew of no active exploitation. That changed. On August 7, a follow-up post reported active and attempted exploitation of unpatched servers. CISA had already added the CVE to the KEV catalog on August 5 with an August 8 deadline, and the catalog marks known use in ransomware campaigns as "Known".

Who is affected#

JetBrains says all TeamCity On-Premises versions are affected. Fixes ship in 2025.11.7 and 2026.1.3. For servers that cannot upgrade, JetBrains released a security patch plugin that covers TeamCity 2017.1 and later. TeamCity 2024.03 and newer download it automatically and list it under Administration, Updates. JetBrains says TeamCity Cloud is already mitigated and it found no evidence of Cloud environments being exploited.

Do you really need to act?#

If you self-host TeamCity, yes. The bug needs no credentials and no user interaction, CISA's SSVC rating calls it automatable with total technical impact, and it is being exploited. A CI server is an unusually valuable target. JetBrains warns that a successful attack can expose stored credentials and configuration and can compromise the integrity of build artifacts and downstream pipelines. That makes this a potential supply-chain incident, not just one compromised box.

A server reachable only from a trusted internal network is less exposed, but anything that can reach the HTTP(S) port, including a compromised build agent or a developer laptop, can attempt the exploit. JetBrains' own advice is that merely exposing the login screen or REST API gives attackers an entry point.

What to do now#

  1. Check the version in the page footer or under Administration, Server Administration. If it is older than 2025.11.7 or 2026.1.3, upgrade through the automatic update option or by installing the new package.
  2. If you cannot upgrade today, install the security patch plugin. Servers on 2017.1 to 2018.1 need a restart. From 2018.2 onward the plugin can be enabled without one. JetBrains notes the plugin fixes only this CVE.
  3. If neither is possible right away, block external access to the server until it is.
  4. After patching, investigate as described below. Upgrading does not undo anything an attacker already did.
  5. If you find signs of compromise, rotate every secret TeamCity holds (VCS tokens, cloud and registry credentials, signing keys, deploy keys) and rebuild artifacts produced since the earliest suspicious log entry.
  6. Longer term, follow JetBrains' guidance: put TeamCity behind a VPN, run the server with minimal OS privileges, and keep build agents on separate hosts.

How to tell if you were hit#

JetBrains suggests searching server logs for com.thoughtworks.xstream.converters.ConversionException, for example grep -r ConversionException <TeamCity>/logs/. A hit does not prove compromise, but it warrants investigation. On patched servers, com.thoughtworks.xstream.security.ForbiddenClassException means an attempt was blocked. Also review the unauthorized build agents list for unexpected entries, especially agents whose names start with scan. JetBrains says these can be removed, and that the log timestamps, not the agent's displayed date, tell you when an attempt happened. Beyond that, look on the host for unfamiliar processes, accounts, scheduled tasks or outbound connections from the TeamCity service user.

Timeline#

  • — Antoni Tremblay privately reports the vulnerability to JetBrains.
  • — JetBrains publishes the advisory, TeamCity 2025.11.7 and 2026.1.3, and the security patch plugin. CVE published.
  • — CISA adds CVE-2026-63077 to KEV, due Aug 8. Ransomware use is marked Known.
  • — JetBrains reports active exploitation and publishes log indicators.

Vulnerability records

  • CVE-2026-63077 · KEV 2026-08-05 · In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. JetBrains — Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077) blog.jetbrains.com
  2. JetBrains — CVE-2026-63077 update: active exploitation and investigation guidance blog.jetbrains.com
  3. JetBrains — Fixed security issues jetbrains.com
  4. CVE record — CVE-2026-63077 cve.org
  5. CISA — Known Exploited Vulnerabilities: CVE-2026-63077 cisa.gov
  6. NVD — CVE-2026-63077 nvd.nist.gov