Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2026-07-27

CVE-2026-63077

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

  1. First PoC
  2. 5 days →KEV
  3. 23 days →Metasploit

Signals

Exploited in the wild
Yesadded 2026-08-05 · due 2026-08-08 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast
90%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

8 known · links only

GitHub PoCs · by trust, then stars6

  1. sfewer-r7/CVE-2026-63077 ↗Trust ok 100

    Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)

    ★ 20 · created 2026-08-07

  2. 0xCyp1337/CVE-2026-63077 ↗Trust ok 100

    CVE-2026-63077 - Unauthenticated RCE exploit for JetBrains TeamCity via Agent Polling Deserialization. Supports mass scanning, multi-threading, and interactive shell. For authorized security testing only.

    ★ 0 · created 2026-09-04

  3. AnggaTechI/CVE-2026-63077 ↗Trust ok 100

    CVE-2026-63077 — Unauthenticated Remote Code Execution in JetBrains TeamCity via agent polling protocol deserialization. CVSS 9.8 CRITICAL. Mass exploitation tool with interactive shell, multi-threading, and real-time result logging.

    ★ 0 · created 2026-08-08

  4. bakos-sandor-nx/teamcity-cve-2026-63077-remediation ↗Trust ok 100

    JetBrains TeamCity On-Premises CVE-2026-63077 Emergency Hardening & Patch Runbook Package

    ★ 0 · created 2026-08-19

  5. BoredHackerBlog/teamcity-CVE-2026-63077-pcap ↗Trust ok 100

    teamcity teamcity-CVE-2026-63077 exploitation pcap

    ★ 0 · created 2026-08-08

  6. unveiledhistory49/teamcity-cve-2026-63077-remediation ↗Trust ok 100

    JetBrains TeamCity On-Premises CVE-2026-63077 Emergency Hardening & Patch Runbook Package

    ★ 0 · created 2026-07-30

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit1

  1. JetBrains TeamCity Agent Polling Unauthenticated Remote Code Execution ↗

    This module exploits an unsafe XStream deserialization vulnerability in the JetBrains TeamCity agent polling protocol. An unauthenticated attacker can register a build agent, then submit a crafted error response that causes TeamCity to deserialize an attacker-controlled object graph. The object graph uses FreeMarker and Commons Collections to invoke BasicDataSource.getConnection(). HSQLDB initialization statements then write a one-shot JSPWS file to the T

    ruby · seen 2026-10-18

Nuclei1

  1. JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution ↗

    JetBrains TeamCity < 2026.1.3, 2025.11.7 contains a remote code execution caused by unsafe XStream deserialization in the unauthenticated agent polling protocol. The XStream instance serving /app/agents/v1 is created without NoTypePermission.NONE, so XStream's default type permissions (Throwable, Map and Collection hierarchies) remain in effect next to the TeamCity allowlist. An unauthenticated attacker registers an agent, obtains a TeamCity-AgentSessionId, and posts an XStream XML object graph

    yaml · seen 2026-10-18

On the wire

2 dispatches
  1. Metasploit Wrap Up: This One Goes to Sixteen!KEV
  2. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)KEV

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.