Executive Summary
Following reports of active exploitation in the wild, CISA has added CVE-2026-63077, a critical unsafe deserialization vulnerability in JetBrains TeamCity, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw allows unauthenticated remote attackers to execute arbitrary operating system commands with the privileges of the TeamCity server process by targeting the unauthenticated agent polling protocol. Because TeamCity serves as a central CI/CD build server holding repository access keys, cloud credentials, and deployment secrets, exploitation enables devastating software supply-chain compromises.
Deep-Dive Technical Analysis
Rapid7 and JetBrains security analysis reveals that CVE-2026-63077 stems from an incomplete allowlist configuration within TeamCity's XStream Java deserialization library.
Vulnerability Mechanics
1. Agent Polling Protocol Exposure: TeamCity exposes an unauthenticated HTTP/HTTPS endpoint used by build agents to poll the main server.
2. Permissive XStream Allowlist: When servicing agent polling requests, TeamCity configures an XStream deserialization allowlist. However, this allowlist incorrectly appended TeamCity-specific protocol classes without explicitly clearing XStream's default permissive fallback handling.
3. Arbitrary Code Execution: An unauthenticated remote attacker transmits a serialized Java object payload containing gadget chains. The server deserializes the payload, triggering arbitrary OS command execution under the TeamCity server process context.
JetBrains remediated the flaw by prepending NoTypePermission.NONE prior to defining the custom allowlist, effectively revoking default XStream permissions and enforcing a strict, exclusive allowlist.
Industry Impact and Recommendations
CI/CD platforms are primary targets for supply-chain attacks. A compromised build server allows attackers to inject malicious backdoors directly into production software releases or steal cloud deployment keys.
Essential Mitigation Actions
* Apply JetBrains Updates: Upgrade TeamCity servers immediately to the latest patched version.
* Restrict Server Access: Place TeamCity servers behind firewall boundaries and restrict agent-polling endpoints to trusted build agent IP ranges.
* Secrets Management: Audit CI/CD build parameters and rotate all cloud tokens, SSH keys, and signing certificates stored in TeamCity.
* Implement EDR Monitoring: Deploy Endpoint Detection and Response (EDR) agents on build servers to detect abnormal child processes spawned by web services.