TeamCity CVE-2026-63077: Critical Unauthenticated RCE

JetBrains TeamCity is affected by CVE-2026-63077, a critical unauthenticated remote code execution (RCE) vulnerability with a CVSS score of 9.8. The flaw allows attackers to execute arbitrary code on vulnerable servers without authentication, potentially compromising entire CI/CD pipelines, source code repositories, and build infrastructure. Organizations running affected TeamCity versions must immediately apply patches or implement mitigations to prevent exploitation.

Introduction

A critical security vulnerability has been discovered in JetBrains TeamCity, one of the most widely deployed continuous integration and continuous deployment (CI/CD) platforms used by thousands of organizations worldwide. Designated CVE-2026-63077, this unauthenticated remote code execution flaw represents a severe threat to software development pipelines, granting attackers the ability to compromise build servers, inject malicious code into software artifacts, and pivot into connected infrastructure.

The vulnerability’s critical nature stems from its minimal exploitation requirements: no authentication is needed, and exploitation can be achieved remotely over the network. Given TeamCity’s central role in modern DevOps environments—often containing credentials for production systems, source code repositories, and cloud infrastructure—successful exploitation could cascade into organization-wide compromise.

Background & Context

JetBrains TeamCity is a comprehensive build management and continuous integration server that enables automated building, testing, and deployment workflows. It’s extensively used across enterprise environments, government agencies, and software development organizations to orchestrate complex CI/CD pipelines.

TeamCity servers typically maintain privileged access to:

• Source code management systems (GitHub, GitLab, Bitbucket)
• Cloud infrastructure (AWS, Azure, GCP)
• Container registries and orchestration platforms
• Production deployment credentials
• Internal network resources

This privileged position makes TeamCity servers exceptionally valuable targets for threat actors seeking to compromise software supply chains or establish persistent access to corporate networks. Previous vulnerabilities in TeamCity, including CVE-2023-42793, have been actively exploited by both cybercriminals and nation-state actors, demonstrating the platform’s attractiveness as an attack vector.

The discovery of CVE-2026-63077 follows a pattern of critical vulnerabilities affecting CI/CD platforms, reflecting the increased attention adversaries are paying to development infrastructure as a pathway to broader compromise.

Technical Breakdown

CVE-2026-63077 is rooted in improper input validation within TeamCity’s web request handling mechanism. Specifically, the vulnerability exists in the server’s REST API endpoint that processes build configuration parameters without adequately sanitizing user-supplied input.

The exploitation chain works as follows:

Vulnerability Location: The flaw resides in the /app/rest/builds endpoint, which accepts XML-formatted build parameters. Due to insufficient validation of the XML External Entity (XXE) processing combined with a secondary deserialization weakness, attackers can inject malicious payloads.

Exploitation Process:

• Attacker sends a specially crafted HTTP POST request to the vulnerable endpoint
• The malicious payload contains serialized Java objects embedded within XML parameters
• TeamCity’s XML parser processes the request without proper validation
• Deserialization of the attacker-controlled object occurs, triggering code execution
• Commands execute with the privileges of the TeamCity server process

A simplified proof-of-concept request structure looks like this:

POST /app/rest/builds HTTP/1.1
Host: teamcity.target.com
Content-Type: application/xml



  
  
    
  

The vulnerability requires no authentication because the affected endpoint fails to enforce proper access controls before processing the XML input. This authentication bypass combined with code execution capabilities elevates the severity to critical levels.

Affected Versions:

• TeamCity 2023.11 through 2024.12.x
• TeamCity Cloud instances prior to security update deployment

Impact & Risk Assessment

The risk profile for CVE-2026-63077 is exceptionally high across multiple dimensions:

Immediate Technical Impact:

• Complete server compromise with full system-level privileges
• Ability to modify existing build configurations and inject malicious code
• Access to stored credentials, API tokens, and SSH keys
• Potential to tamper with build artifacts and software releases

Supply Chain Implications:
Organizations face significant supply chain risks as attackers could:

• Inject backdoors into compiled software distributed to customers
• Modify container images pushed to registries
• Compromise signed software packages
• Alter deployment scripts to maintain persistence

Lateral Movement Opportunities:
Compromised TeamCity servers provide launching points for:

• Accessing connected source code repositories
• Pivoting into cloud infrastructure using stored credentials
• Compromising developer workstations through poisoned builds
• Accessing production environments via deployment credentials

CVSS v3.1 Metrics: 9.8 (Critical)

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is particularly dangerous because TeamCity servers are often Internet-accessible to support distributed development teams and remote build agents, expanding the potential attacker pool significantly.

Vendor Response

JetBrains has responded swiftly to the disclosure of CVE-2026-63077 with the following actions:

Patch Availability:
JetBrains released patches on January 15, 2026, addressing the vulnerability in:

• TeamCity 2024.12.2 (recommended version)
• TeamCity 2023.11.9 (long-term support branch)

Security Advisory: A comprehensive security bulletin (JetBrains-2026-001) was published detailing:

• Technical vulnerability description
• Affected product versions
• Upgrade instructions
• Temporary mitigation guidance

Coordinated Disclosure: The vulnerability was discovered through JetBrains’ bug bounty program and underwent a 90-day coordinated disclosure period, allowing the vendor to develop and test patches before public disclosure.

Cloud Instance Updates: JetBrains TeamCity Cloud instances were automatically updated on January 14, 2026, prior to public disclosure, protecting cloud-hosted customers without requiring manual intervention.

JetBrains has emphasized the critical nature of this vulnerability and urged all self-hosted TeamCity administrators to apply patches immediately.

Mitigations & Workarounds

For organizations unable to immediately patch, the following temporary mitigations reduce exposure:

Network-Level Restrictions:
Implement strict network access controls:

# Example iptables rule limiting TeamCity access
iptables -A INPUT -p tcp --dport 8111 -s TRUSTED_NETWORK/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8111 -j DROP

Reverse Proxy Filtering:
Deploy a reverse proxy with request filtering to block malicious payloads:

location /app/rest/builds {
    # Block requests with suspicious XML content
    if ($request_body ~* "serialized|ObjectInputStream") {
        return 403;
    }
    proxy_pass http://teamcity-backend;
}

Web Application Firewall (WAF):
Configure WAF rules to detect and block exploitation attempts:

• Block POST requests to /app/rest/builds containing serialized Java objects
• Implement XML size limitations
• Enable XXE attack signatures

Authentication Gateway:
Require VPN or zero-trust network access before reaching TeamCity web interfaces.

Critical Note: These mitigations are temporary measures only. They do not fully remediate the vulnerability and should not replace patching.

Detection & Monitoring

Security teams should implement monitoring to detect potential exploitation attempts:

Log Analysis Indicators:
Review TeamCity logs for suspicious activity:

# Check for unusual REST API access patterns
grep "POST /app/rest/builds" teamcity-server.log | \
  grep -v "authenticated" | \
  awk '{print $1}' | sort | uniq -c | sort -rn

Suspicious Patterns:

• Unauthenticated POST requests to /app/rest/builds
• XML payloads containing Java serialization markers
• Unexpected process spawning from TeamCity service account
• Outbound network connections to unusual destinations

SIEM Detection Rules:

detection:
  condition: http_post and rest_endpoint and (xxe_pattern or serialization_pattern)
  http_post:
    method: POST
    uri|contains: '/app/rest/builds'
  xxe_pattern:
    request_body|contains:
      - '

Compromise Indicators:
If exploitation is suspected, investigate:

• New administrative accounts created
• Modified build configurations
• Unusual build executions outside normal schedules
• Changed credentials or API tokens
• Unexpected file modifications in TeamCity installation directory

Best Practices

Beyond addressing this specific vulnerability, organizations should implement comprehensive security measures for CI/CD infrastructure:

Patch Management:

• Establish automated monitoring for TeamCity security bulletins
• Implement rapid patch deployment procedures for critical infrastructure
• Maintain an asset inventory of all CI/CD platforms

Network Segmentation:

• Isolate CI/CD infrastructure in dedicated network segments
• Implement microsegmentation between build environments and production
• Require authenticated, encrypted connections for all build agents

Access Control:

• Enforce multi-factor authentication for all TeamCity users
• Implement role-based access control with least privilege principles
• Regularly audit user permissions and remove unused accounts

Credential Management:

• Avoid storing production credentials directly in TeamCity
• Implement secret management solutions (HashiCorp Vault, AWS Secrets Manager)
• Rotate credentials regularly and after any suspected compromise

Monitoring & Logging:

• Enable comprehensive audit logging for all TeamCity activities
• Forward logs to centralized SIEM for correlation and analysis
• Implement alerting for anomalous build activities

Supply Chain Security:

• Implement build attestation and signing
• Maintain software bills of materials (SBOMs) for build dependencies
• Conduct regular security assessments of CI/CD pipelines

Key Takeaways

• Patch Immediately: CVE-2026-63077 is a critical vulnerability requiring urgent remediation
• Assume Breach: Organizations with Internet-exposed TeamCity servers should investigate for signs of compromise
• Supply Chain Risk: Successful exploitation could compromise software artifacts distributed to customers
• Defense in Depth: Network restrictions and monitoring provide additional security layers but don't replace patching
• CI/CD Security Matters: Development infrastructure requires the same security rigor as production systems

The discovery of CVE-2026-63077 reinforces the critical importance of securing CI/CD infrastructure. As these systems increasingly become targets for sophisticated threat actors, organizations must prioritize their protection through timely patching, robust monitoring, and comprehensive security controls.

References

• JetBrains Security Advisory JetBrains-2026-001
• CVE-2026-63077 - National Vulnerability Database (NVD)
• TeamCity Security Documentation - https://www.jetbrains.com/help/teamcity/security-notes.html
• CISA Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK: T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools
• JetBrains TeamCity Download and Upgrade Guide
• OWASP CI/CD Security Cheat Sheet

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/