0xcyp1337/cve-2026-63077Exploit for CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity via deserialization. Supports mass scanning, multi-threading, and interactive shell for authorized testing.
-red.svg){kind=icon}
Critical Unauthenticated Remote Code Execution (CVSS 9.8) — Actively Exploited in the Wild
This repository contains a fully functional proof-of-concept (PoC) exploit for CVE-2026-63077, a critical deserialization vulnerability in JetBrains TeamCity that allows unauthenticated attackers to execute arbitrary commands on the server.
The exploit leverages the Agent Registration endpoint (/app/agents/v1/register) to establish a malicious agent session, then sends a crafted linked-hash-map payload to the /app/agents/v1/commands/error endpoint. This triggers an HSQLDB deserialization attack that writes a JSP webshell to the TeamCity webroot (../webapps/ROOT), granting remote command execution.
| Property | Value |
|---|---|
| CVE ID | CVE-2026-63077 |
| CVSS Score | 9.8 (Critical) |
| CWE | CWE-502 – Deserialization of Untrusted Data |
| Disclosure Date | August 2026 |
| Status | Actively Exploited in the Wild |
| Affected Product | JetBrains TeamCity (versions before patch) |
The vulnerability exists in the Agent Polling mechanism. By registering a rogue agent with a custom authToken, an attacker can send a malicious XML payload that triggers HSQLDB deserialization. The payload creates a JSP file in the webroot with a command execution scriptlet. Once the JSP is accessed, it executes the provided system command and returns the output.
Exploit Chain:
/app/agents/v1/register with XML./app/agents/v1/commands/error with crafted linked-hash-map.SCRIPT command to write JSP file to disk.webapps/ROOT)result.txt)# Clone the repository
git clone https://github.com/yourusername/CVE-2026-63077.git
cd CVE-2026-63077
python3 CVE-2026-63077.py
# No additional dependencies are required — uses urllib, socket, ssl, etc.