JetBrains TeamCity Unauthenticated Remote Code Execution Vulnerability via Agent Polling Protocol (CVE-2026-63077)

Remediation & Mitigation Guide

1. Apply Official Security Patches (Highly Recommended)

Immediately upgrade your TeamCity server to a patched version.

• Patched Versions: 2026.1.3 or 2025.11.7 and above

2. Temporary Mitigations (If immediate patching is not possible)

If you cannot apply the patch immediately, implement the following network and security controls:

• Network Access Control Lists (ACLs)

Restrict access to the TeamCity server's agent communication port (default web port or dedicated port) to only trusted, known IP addresses of your build agents.

  # Example: Allow only trusted agent subnet (e.g., 192.168.10.0/24) to TeamCity port (e.g., 8111)
  iptables -A INPUT -p tcp -s 192.168.10.0/24 --dport 8111 -j ACCEPT
  iptables -A INPUT -p tcp --dport 8111 -j DROP

• WAF (Web Application Firewall) Rules

Configure your WAF to inspect and block POST requests to agent polling endpoints (such as /RPC2 or /app/agents) that contain Java serialization signatures (e.g., hex magic bytes AC ED 00 05).

Technical Analysis

This vulnerability (CVE-2026-63077) is a critical unauthenticated Remote Code Execution (RCE) vulnerability in JetBrains TeamCity, specifically residing within the Agent Polling Protocol.

Root Cause (CWE-502: Deserialization of Untrusted Data)

The TeamCity server processes serialized object data received from build agents during communication and status reporting. The root cause is the unsafe deserialization of user-controlled input without proper validation (CWE-502).

Exploit Mechanics

• Authentication Bypass: An attacker targets the agent communication port (typically the main web port or a dedicated agent port). Because this protocol is designed to accept connections from external agents, it does not require standard user authentication.
• Payload Delivery: The attacker sends a crafted serialized Java object containing a malicious gadget chain via the agent polling request.
• Execution: When the TeamCity server deserializes the payload, the embedded malicious commands are executed with the privileges of the TeamCity server process.

Impact and Real-world Risk

• CVSS 9.8 (Critical) & CISA KEV Listed: This vulnerability is actively exploited in the wild, posing an immediate threat to exposed instances.
• CI/CD Pipeline Compromise: Successful exploitation allows attackers to compromise the entire CI/CD pipeline, potentially leading to source code theft or supply chain attacks by tampering with build artifacts.