Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning and added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) Catalog following active, wild exploitation targeting the JetBrains TeamCity On-Premises CI/CD build platform. With a maximum CVSS score of 9.8, this critical vulnerability stems from the unsafe deserialization of untrusted user input within the server's HTTP processing pipeline.
Unauthenticated remote threat actors are actively leveraging this flaw to bypass authentication controls and execute arbitrary operating system commands with full privileges of the TeamCity server process. Because TeamCity servers manage source code repositories, deployment keys, and production pipeline credentials, successful exploitation grants attackers full supply-chain access to enterprise software builds.
Deep-Dive Technical Analysis
CVE-2026-63077 impacts all TeamCity On-Premises installations prior to versions 2025.11.7 and 2026.1.3.
Mechanism of Vulnerability
The root cause lies in how TeamCity handles serialized Java objects transmitted via specific unauthenticated HTTP/HTTPS endpoints.
* Unsafe Java Deserialization: The TeamCity web application controller fails to properly validate or sanitize incoming serialized Java object streams delivered in custom HTTP header payloads or POST request bodies.
* Authentication Bypass: By crafting a specialized gadgets-chain payload (leveraging common Java libraries embedded within the TeamCity classpath), an unauthenticated attacker can force the Java Virtual Machine (JVM) to instantiate arbitrary objects during the deserialization phase—completely bypassing TeamCity's authentication and authorization middleware.
* Arbitrary Command Execution: Once the object chain triggers, the attacker achieves arbitrary command execution under the service account running the TeamCity process (often SYSTEM on Windows or root/teamcity on Linux).
Threat Actor Exploitation Tactics
CISA and private threat intelligence firms report that threat actors are using automated scanning scripts to identify internet-facing TeamCity instances on port 8111. Once identified, attackers deliver a deserialization payload that:
1. Drops persistent web shells into the web root directory (/webapps/ROOT/).
2. Steals stored VCS (Version Control System) credentials.
3. Attempts lateral movement across connected build agents.
Industry Impact and Mitigation Strategies
CI/CD platforms are high-value targets because compromising a build server allows attackers to inject malicious code directly into downstream commercial software products, leading to classic software supply-chain attacks.
Urgent Action Items & Containment
Action Category
Recommended Mitigation Steps
Immediate Patching
Upgrade all JetBrains TeamCity On-Premises installations immediately to version 2026.1.3 or 2025.11.7. For legacy deployments (version 2017.1+), apply JetBrains' official security patch plugin immediately.
Network Isolation
Restrict access to TeamCity management interfaces behind enterprise VPNs, zero-trust network access (ZTNA) gateways, or strict IP whitelisting.
Credential Rotation
Rotate all production tokens immediately, including VCS SSH keys, AWS access tokens, or Docker registry credentials stored within an unpatched instance.
Audit System Logs for Indicators of Compromise (IoCs)
* Traffic Inspection: Inspect TeamCity server logs (teamcity-vcs.log and teamcity-server.log) for unexpected HTTP POST requests to unauthenticated endpoints yielding 200 OK status with unusual payload sizes.
* Process Monitoring: Review process execution trees spawned by the Java process (java.exe or java) for anomalous child processes such as cmd.exe, powershell.exe, /bin/sh, or /bin/bash.
Source: SecurityWeek — Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability