CVE-2026-63077

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2026.1.3 JetBrains TeamCity versions prior to 2025.11.7

Description An unauthenticated remote attacker can execute arbitrary operating system commands with the privileges of the TeamCity Server process by sending specially crafted HTTP requests. The issue stems from insecure deserialization of XML data processed via the agent polling protocol using the XStream library. Specifically, the server fails to clear default XStream permissions, allowing the use of gadget chains to write malicious JSP files into the webroot.

Technical details include:

Approximately 4,500 installations were detected exposed to the internet. Real-world exploitation has been confirmed, including a significant breach of the JetBrains Cadence cloud service. In that incident, attackers accessed a full 2024 server backup, exposing personal data, AWS IAM credentials, and potentially synchronized source code. The breach also affected S3 buckets within JetBrains AWS accounts.

Recommendations Upgrade to version 2026.1.3 or 2025.11.7. Install the security patch plugin for versions 2017.1 and later; for versions 2017.1 through 2018.1, a server restart is required after installation. Limit network access to the server to trusted networks and restrict access to the login page and REST API. Run the TeamCity server under an operating system account with the minimum privileges required for normal operation. Deploy TeamCity servers on dedicated hosts separate from build agents. As a temporary mitigation, restrict access to the /app/agents/v1/* routes from external networks.