Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
A critical unauthenticated remote code execution (RCE) vulnerability has been identified in JetBrains TeamCity, tracked as CVE-2026-63077. The flaw stems from improper XStream configuration that allows unsafe deserialization of attacker-controlled XML payloads through the agent polling protocol. Attackers can exploit this without authentication to execute arbitrary commands on affected servers.
CISA confirmed exploitation in the wild after adding the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on August 5, 2026. JetBrains patched the issue in version 2026.1.3 by resetting XStream permissions before applying TeamCity's allowlist. A proof-of-concept script demonstrates how attackers could deploy a malicious JSP file to achieve persistent server-side command execution.
Organizations running vulnerable versions should update to 2026.1.3 or later immediately. Indicators of compromise include unusual error logs referencing HSQLMetadataStorage$SchemaMismatchException and unexpected .jspws files in the webroot directory.
Overview
On July 27, 2026, JetBrains published a security advisory for CVE-2026-63077, a critical unsafe deserialization vulnerability affecting JetBrains TeamCity. An attacker who can reach a TeamCity server over HTTP or HTTPS can exploit the agent polling protocol without credentials and execute operating system commands with the privileges of the TeamCity server process.…