---
title: "TeamCity CVE-2026-63077: Unauthenticated RCE, Exploited"
url: https://erroneo.us/security/briefs/teamcity-cve-2026-63077-unauthenticated-rce/
description: "All TeamCity On-Premises versions before 2025.11.7/2026.1.3 allow unauthenticated RCE via agent polling. In KEV, ransomware use known. Patch now."
type: security-brief
section: "Security Digest"
date_published: 2026-07-27
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-63077"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# TeamCity CVE-2026-63077: Unauthenticated RCE, Exploited

**Verdict: Act now.** Any self-hosted TeamCity server below 2025.11.7 or 2026.1.3 that an attacker can reach over HTTP(S) can be taken over without credentials, and ransomware crews are using it; patch or apply the security patch plugin today, then check for intrusions.

- **Who must act:** Everyone running TeamCity On-Premises older than 2025.11.7 or 2026.1.3 without JetBrains' security patch plugin, above all internet-facing servers.
- **Who can relax:** TeamCity Cloud customers, whom JetBrains says need no action, and on-prem servers already on 2025.11.7, 2026.1.3 or later, or with the patch plugin installed.
- **Affected:** TeamCity On-Premises, all versions before 2025.11.7 and 2026.1.3
- **Fixed:** TeamCity 2025.11.7; TeamCity 2026.1.3; Security patch plugin for TeamCity 2017.1 and later
- **CVEs:** CVE-2026-63077
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Upgrade TeamCity On-Premises to 2025.11.7 or 2026.1.3 (or later), or install the CVE-2026-63077 security patch plugin.
2. If you cannot patch right away, cut off external access to the server.
3. Search server logs for com.thoughtworks.xstream.converters.ConversionException and investigate any hits.
4. Remove unexpected unauthorized build agents, especially ones whose names start with scan.
5. If compromise is suspected, rotate every secret TeamCity stores (VCS tokens, cloud keys, deploy credentials) and verify recent build artifacts.
6. Longer term: put TeamCity behind a VPN, run it with least privilege, and keep agents on separate hosts.

### How to check if you are affected

- grep teamcity-server.log and related logs for com.thoughtworks.xstream.converters.ConversionException (possible attempt or success).
- After patching, ForbiddenClassException entries mean an attempt was blocked.
- Check Agents > Unauthorized for unknown agents, particularly names beginning with scan; trust log timestamps, not the agent date.
- Look for unexpected processes, users or outbound connections from the TeamCity server host.

## What happened

On July 27, 2026, JetBrains [disclosed CVE-2026-63077](https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/), a critical flaw in TeamCity On-Premises. An unauthenticated attacker who can reach the server over HTTP(S) can abuse the TeamCity agent polling protocol to get past authentication checks and run operating system commands with the privileges of the TeamCity server process. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-63077) classifies it as deserialization of untrusted data (CWE-502) and scores it CVSS 3.1 9.8. JetBrains' later guidance points to XStream exceptions in the logs. Antoni Tremblay reported the bug privately on July 10.

When it disclosed the bug, JetBrains said it knew of no active exploitation. That changed. On August 7, a [follow-up post](https://blog.jetbrains.com/teamcity/2026/08/cve-2026-63077-update/) reported active and attempted exploitation of unpatched servers. CISA had already added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077) on August 5 with an August 8 deadline, and the catalog marks known use in ransomware campaigns as "Known".

## Who is affected

JetBrains says all TeamCity On-Premises versions are affected. Fixes ship in 2025.11.7 and 2026.1.3. For servers that cannot upgrade, JetBrains released a security patch plugin that covers TeamCity 2017.1 and later. TeamCity 2024.03 and newer download it automatically and list it under Administration, Updates. JetBrains says TeamCity Cloud is already mitigated and it found no evidence of Cloud environments being exploited.

## Do you really need to act?

If you self-host TeamCity, yes. The bug needs no credentials and no user interaction, CISA's SSVC rating calls it automatable with total technical impact, and it is being exploited. A CI server is an unusually valuable target. JetBrains warns that a successful attack can expose stored credentials and configuration and can compromise the integrity of build artifacts and downstream pipelines. That makes this a potential supply-chain incident, not just one compromised box.

A server reachable only from a trusted internal network is less exposed, but anything that can reach the HTTP(S) port, including a compromised build agent or a developer laptop, can attempt the exploit. JetBrains' own advice is that merely exposing the login screen or REST API gives attackers an entry point.

## What to do now

1. Check the version in the page footer or under Administration, Server Administration. If it is older than 2025.11.7 or 2026.1.3, upgrade through the automatic update option or by installing the new package.
2. If you cannot upgrade today, install the security patch plugin. Servers on 2017.1 to 2018.1 need a restart. From 2018.2 onward the plugin can be enabled without one. JetBrains notes the plugin fixes only this CVE.
3. If neither is possible right away, block external access to the server until it is.
4. After patching, investigate as described below. Upgrading does not undo anything an attacker already did.
5. If you find signs of compromise, rotate every secret TeamCity holds (VCS tokens, cloud and registry credentials, signing keys, deploy keys) and rebuild artifacts produced since the earliest suspicious log entry.
6. Longer term, follow JetBrains' guidance: put TeamCity behind a VPN, run the server with minimal OS privileges, and keep build agents on separate hosts.

## How to tell if you were hit

JetBrains suggests searching server logs for `com.thoughtworks.xstream.converters.ConversionException`, for example `grep -r ConversionException <TeamCity>/logs/`. A hit does not prove compromise, but it warrants investigation. On patched servers, `com.thoughtworks.xstream.security.ForbiddenClassException` means an attempt was blocked. Also review the unauthorized build agents list for unexpected entries, especially agents whose names start with `scan`. JetBrains says these can be removed, and that the log timestamps, not the agent's displayed date, tell you when an attempt happened. Beyond that, look on the host for unfamiliar processes, accounts, scheduled tasks or outbound connections from the TeamCity service user.

## Timeline

- Jul 10, 2026 — Antoni Tremblay privately reports the vulnerability to JetBrains.
- Jul 27, 2026 — JetBrains publishes the advisory, TeamCity 2025.11.7 and 2026.1.3, and the security patch plugin. CVE published.
- Aug 5, 2026 — CISA adds CVE-2026-63077 to KEV, due Aug 8. Ransomware use is marked Known.
- Aug 7, 2026 — JetBrains reports active exploitation and publishes log indicators.

## Sources

1. [JetBrains — Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077)](https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/)
2. [JetBrains — CVE-2026-63077 update: active exploitation and investigation guidance](https://blog.jetbrains.com/teamcity/2026/08/cve-2026-63077-update/)
3. [JetBrains — Fixed security issues](https://www.jetbrains.com/privacy-security/issues-fixed/)
4. [CVE record — CVE-2026-63077](https://www.cve.org/CVERecord?id=CVE-2026-63077)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-63077](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077)
6. [NVD — CVE-2026-63077](https://nvd.nist.gov/vuln/detail/CVE-2026-63077)

---
Source page: https://erroneo.us/security/briefs/teamcity-cve-2026-63077-unauthenticated-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt