Listen to this Post
Introduction
The Australian Cyber Security Centre (ACSC) has issued a high-severity alert following confirmed active exploitation of CVE-2026-63077, a critical unauthenticated remote code execution vulnerability affecting JetBrains TeamCity On-Premises servers. This vulnerability, assigned a CVSS score of 9.8 out of 10, allows an unauthenticated attacker with HTTP(S) access to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. TeamCity sits at the heart of CI/CD pipelines, typically holding source code access tokens, cloud provider credentials, deployment secrets, and build configurations connecting to production environments. A successful compromise extends far beyond a single server—attackers gain access to everything that machine is configured to reach and the ability to modify build artifacts before they ship to production. With roughly 4,500 TeamCity web properties reachable from the internet at the time of disclosure, the attack surface is substantial.
Learning Objectives & Secrets
- Objective 1: Understand the vulnerability mechanics and its root cause. CVE-2026-63077 is a deserialization of untrusted data flaw in TeamCity’s agent polling protocol. The vulnerability stems from an overly permissive XStream configuration where TeamCity’s own protocol classes were added to the server’s allow-list without first clearing the underlying XStream serialization library’s default permissions. This allowed attacker-controlled data to bypass authentication checks and trigger arbitrary OS command execution.
-
Objective 2 secret tips: Leverage network segmentation and access controls as a defensive layer. Even if patching is delayed, restricting network access to TeamCity servers can significantly reduce risk. Place internet-facing TeamCity servers behind a VPN or additional protective access layer. Use firewall rules to restrict access to trusted IP ranges and implement application-layer filtering to block suspicious payloads. Regularly review whether the TeamCity interface truly needs to be exposed to the internet.
-
Objective 3 secret tips: Hunt for indicators of compromise proactively. Review TeamCity server logs for occurrences of the `com.thoughtworks.xstream.converters.ConversionException` message—while this alone does not confirm exploitation, it may indicate an attempted or successful exploit and warrants further investigation. Examine historical logs for anomalous requests to the agent polling endpoint from unauthenticated sources, unexpected new files on the server, and altered artifacts. If compromise is suspected, rotate all credentials stored in TeamCity immediately.
You Should Know
1. Vulnerability Scope and Affected Versions
CVE-2026-63077 affects all TeamCity On-Premises versions prior to 2025.11.7 and 2026.1.3. TeamCity Cloud customers are not affected, as the necessary mitigations have already been applied to hosted infrastructure. The vulnerability was reported privately to JetBrains on July 10, 2026, and fixed versions were released on July 27, 2026. However, active exploitation was subsequently observed in Australia, prompting the ACSC to issue its high-severity alert on August 24, 2026. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 5, 2026.
2. How to Identify Vulnerable TeamCity Servers
Linux Command to Check TeamCity Version:
Check the TeamCity version from the build number file
cat /opt/teamcity/buildAgent/conf/buildAgent.properties | grep version
Alternatively, check the TeamCity webapp version
find /opt/teamcity -1ame "teamcity-main.jar" -exec basename {} \;
Check via the TeamCity REST API (authenticated)
curl -s -u <username>:<password> "http://<teamcity-server>:8111/app/rest/server" | grep -i version
Windows Command (PowerShell) to Check TeamCity Version:
Check version from buildAgent.properties
Get-Content "C:\TeamCity\buildAgent\conf\buildAgent.properties" | Select-String "version"
Check installed TeamCity version via registry
Get-ItemProperty "HKLM:\SOFTWARE\JetBrains\TeamCity" -1ame "Version" -ErrorAction SilentlyContinue
Check via WMI for installed applications
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "TeamCity" } | Select-Object Name, Version
Quick Version Assessment:
- If version is 2025.11.7 or higher, or 2026.1.3 or higher → PATCHED
- If version is below 2025.11.7 or between 2026.1.0 and 2026.1.2 → VULNERABLE – PATCH IMMEDIATELY
3. Patching and Mitigation Steps
Option 1: Upgrade to Fixed Version (Recommended)
Download and install TeamCity 2025.11.7 or 2026.1.3 from the official JetBrains download page. These versions include the fix for CVE-2026-63077 along with more than 20 other security vulnerability fixes.
Option 2: Install Security Patch Plugin (For Legacy Versions)
If immediate upgrade is not possible, install the security patch plugin available for TeamCity 2017.1 and later:
Download URL: https://download.jetbrains.com/teamcity/plugins/internal/fix_CVE_2026_63077.zip
For TeamCity 2024.03 and newer, the server automatically downloads available security patches and notifies administrators. Review and apply pending security patches from Administration → Updates under “Available security updates”. For TeamCity 2017.1 to 2018.1, a server restart is required after installation. Starting from TeamCity 2018.2, the plugin can be enabled without restarting.
Note: The security patch plugin addresses only CVE-2026-63077. Upgrading to the latest version is always recommended to benefit from other security updates.
4. Root Cause Analysis
The vulnerability is caused by unsafe deserialization of untrusted data in TeamCity’s agent polling protocol. TeamCity’s XStream configuration allowed TeamCity classes without first clearing its default permissions, leaving the deserialization process overly permissive. The fix involves adding `NoTypePermission.NONE` before the TeamCity allowlist, which removes the default permissions and makes the allowlist exclusive rather than additive. This critical oversight transformed a routine protocol handler into an unauthenticated RCE vector.
The attack flow typically follows these steps:
- Attacker identifies an internet-exposed TeamCity server running a vulnerable version
- Attacker crafts a malicious serialized payload targeting the agent polling protocol
- Payload is sent over HTTP/HTTPS to the vulnerable endpoint
- TeamCity deserializes the untrusted data without proper validation
- Attacker gains arbitrary OS command execution with server process privileges
5. Indicators of Compromise and Detection
Log-Based Detection:
Review TeamCity server logs for the following message, which may indicate attempted exploitation:
com.thoughtworks.xstream.converters.ConversionException
Network-Based Detection:
- Monitor for anomalous requests to the agent polling endpoint from unauthenticated sources
- Look for unexpected HTTP POST requests with unusual payload sizes or structures
- Check for outbound connections from the TeamCity server to unknown external IPs
File System and Artifact Detection:
- Unexpected new files created on the TeamCity server
- Altered build artifacts or modifications to build configurations
- Changes to stored credentials, access tokens, or deployment secrets
Linux Commands for Forensic Investigation:
Search for the ConversionException in TeamCity logs grep -r "ConversionException" /opt/teamcity/logs/ Check for recently modified files in the TeamCity directory find /opt/teamcity -type f -mtime -7 -ls Review authentication logs for suspicious activity tail -1 1000 /var/log/auth.log | grep -i "teamcity" Check for unexpected running processes ps aux | grep -i teamcity | grep -v grep Examine network connections from the TeamCity server ss -tunap | grep -i teamcity netstat -tunap | grep -i teamcity
Windows PowerShell Commands for Forensic Investigation:
Search for ConversionException in TeamCity logs
Select-String -Path "C:\TeamCity\logs\" -Pattern "ConversionException"
Find recently modified files in TeamCity directory
Get-ChildItem -Path "C:\TeamCity" -Recurse | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
Check for unexpected processes
Get-Process | Where-Object { $_.ProcessName -like "teamcity" }
Examine network connections
netstat -ano | Select-String -Pattern "8111"
6. Network Hardening and Access Control
Immediate Network Hardening Steps:
- Restrict Internet Exposure: Assess whether your TeamCity server needs to be exposed to the internet. If possible, move it behind a VPN or implement IP-based access restrictions.
2. Implement Firewall Rules:
Linux iptables example - restrict access to trusted IPs only iptables -A INPUT -p tcp --dport 8111 -s <trusted-ip-range> -j ACCEPT iptables -A INPUT -p tcp --dport 8111 -j DROP Save iptables rules (Debian/Ubuntu) iptables-save > /etc/iptables/rules.v4
Windows Firewall (PowerShell):
Remove existing rule allowing all access to port 8111 (if exists)
Remove-1etFirewallRule -DisplayName "TeamCity Port 8111" -ErrorAction SilentlyContinue
Create rule allowing only trusted IPs
$trustedIPs = @("192.168.1.0/24", "10.0.0.0/8") Replace with your trusted ranges
foreach ($ip in $trustedIPs) {
New-1etFirewallRule -DisplayName "TeamCity Trusted $ip" -Direction Inbound -Protocol TCP -LocalPort 8111 -RemoteAddress $ip -Action Allow
}
New-1etFirewallRule -DisplayName "TeamCity Block Others" -Direction Inbound -Protocol TCP -LocalPort 8111 -Action Block
- Implement Application-Layer Filtering: Deploy a Web Application Firewall (WAF) or IPS in front of TeamCity to detect and block malicious payloads targeting the agent polling protocol. Check Point has released IPS protection for CVE-2026-63077 that detects attempts to exploit this vulnerability.
-
Segment Build Infrastructure: Place TeamCity servers in a dedicated network segment with limited lateral movement paths. Implement strict deserialization memory telemetry monitoring and process execution baseline validation.
7. Third-Party Provider Verification
Organizations using third-party managed TeamCity services—such as through a managed service provider or enterprise IT provider—must confirm patching and monitoring arrangements with their providers. The ACSC specifically urges organizations to:
– Verify that providers have applied the necessary patches
– Confirm that monitoring for indicators of compromise is in place
– Validate that providers have reviewed internet exposure of TeamCity interfaces
What Undercode Say
Key Takeaway 1: The CI/CD Attack Surface Is Expanding
CVE-2026-63077 represents a critical inflection point in the evolution of CI/CD security threats. TeamCity sits at the nexus of software delivery, with access to source code, credentials, infrastructure, and deployment pipelines. This vulnerability demonstrates that development infrastructure is no longer a secondary security concern—it is a primary attack vector that can enable supply chain compromise at scale. Organizations must treat their CI/CD platforms with the same security rigor applied to production environments, including regular vulnerability assessments, network segmentation, and continuous monitoring.
Key Takeaway 2: The Window Between Disclosure and Exploitation Is Shrinking
The timeline of CVE-2026-63077 is telling: disclosed July 27, added to CISA’s KEV catalog on August 5, active exploitation confirmed in Australia by August 24. This pattern mirrors previous TeamCity vulnerabilities—CVE-2023-42793 exploited by APT29, and CVE-2024-27198/27199 exploited within days of disclosure. The window between public disclosure and confirmed exploitation continues to narrow. Organizations cannot afford to treat vulnerability disclosures as routine patching matters. The new operational reality demands faster patch cycles, proactive threat hunting, and a fundamental reassessment of whether critical development infrastructure should be exposed to the internet at all.
Prediction
- +1 The heightened awareness from this vulnerability will accelerate the adoption of Zero Trust architectures for CI/CD pipelines. Organizations will increasingly move toward ephemeral build environments, just-in-time credential access, and network-isolated build infrastructure to minimize the blast radius of similar vulnerabilities.
-
+1 This incident will drive increased investment in software supply chain security tools and practices. The ability to detect and respond to compromised build artifacts will become a standard requirement for mature DevSecOps programs.
-
-1 The active exploitation of CVE-2026-63077 will likely lead to at least one major supply chain compromise before all vulnerable instances are patched. Given the thousands of internet-exposed TeamCity servers and the availability of public proof-of-concept exploit code, it is almost certain that additional compromises will be discovered in the coming weeks.
-
-1 Organizations that fail to patch promptly may face significant business disruption, including data breaches, credential theft, and compromised software releases. The ACSC’s alert underscores the severity of the threat and the need for immediate action.
-
-1 The pattern of recurring critical vulnerabilities in TeamCity—three in two years—raises questions about the security maturity of the platform’s development lifecycle. If this trend continues, organizations may begin migrating to alternative CI/CD solutions, potentially disrupting the DevOps tooling ecosystem.
-
+1 The security community will respond with improved detection capabilities, including SIEM rules, YARA signatures, and automated scanning tools specifically designed to identify exploitation of this vulnerability class. This will enhance the overall security posture of CI/CD environments.
-
-1 Smaller organizations with limited security resources are at the greatest risk. The complexity of patching, combined with the operational criticality of TeamCity servers, may lead to delayed remediation in resource-constrained environments, leaving them vulnerable to opportunistic attackers.
▶️ Related Video (86% Match):
https://www.youtube.com/watch?v=68fngSWGZjA
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/ebq-xEUB – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
