anggatechi/cve-2026-63077CVE-2026-63077 — Unauthenticated Remote Code Execution in JetBrains TeamCity via agent polling protocol deserialization. CVSS 9.8 CRITICAL. Mass exploitation tool with interactive shell, multi-threading, and real-time result logging.
Overview • Visual Flow • Requirements • Usage • Limitations • Mitigation
[!CAUTION] This PoC executes an operating-system command and can modify the TeamCity application directory. Use it only in an isolated lab or against systems for which you have explicit written authorization.
| Property | Value |
|---|---|
| CVE | CVE-2026-63077 |
| Product | JetBrains TeamCity On-Premises |
| Impact | Unauthenticated remote code execution through the agent polling protocol |
| Weakness | CWE-502 — Deserialization of Untrusted Data |
| CVSS | 9.8 Critical — JetBrains CNA, CVSS 3.1 |
| Authentication | Not required |
| Fixed releases | 2025.11.7 and 2026.1.3 |
| Alternative mitigation | JetBrains security patch plugin for TeamCity 2017.1+ |
| TeamCity Cloud | No customer action required according to JetBrains |
JetBrains states that all TeamCity On-Premises releases before the fixed versions are affected. Upgrade to a current supported release whenever possible. If an immediate upgrade is not possible, follow the vendor's instructions for its security patch plugin.
[!NOTE] This repository does not claim that the CVE is listed in the CISA Known Exploited Vulnerabilities catalog. JetBrains reported no known active exploitation when it published its advisory on July 27, 2026.
At a high level, the PoC:
result.txt.The generated JSP attempts to delete itself when invoked. Treat cleanup as best-effort, not as a guarantee that the target is left unchanged.
Python 3.9 or later
Target Authorized TeamCity On-Premises lab instance
Transport HTTP or HTTPS access
Shell bash available on the TeamCity server
Packages Python standard library only
Safety Disposable environment or verified backup
[!IMPORTANT] The payload invokes commands through
bash -c. A Windows TeamCity server therefore requires a compatible Bash installation; otherwise the command execution stage will fail.
Run the PoC from the project directory:
python3 exploit.py
The program asks for a target, a command, and the desired thread count:
[*] Target URL or file: http://127.0.0.1:8111
[*] Command: id
[*] Threads (default 10): 1
Enter the target's full base URL. When the scheme is omitted, the script uses
http:// automatically.
For multiple lab systems, enter the path to a text file with one URL per line:
http://127.0.0.1:8111
http://192.0.2.10:8111
https://teamcity.lab.example
Do not add inline comments to target lines because the parser does not remove them. Start with one thread and increase concurrency only after confirming the scope and capacity of the authorized lab.
Successful results are appended to result.txt:
http://127.0.0.1:8111 -> uid=1000(tcuser) gid=1000(tcuser) groups=1000(tcuser)
The file may contain sensitive command output. Keep it out of version control and delete it securely when it is no longer required.
bash is available on the TeamCity server.../webapps/ROOT; nonstandard TeamCity or
servlet-container layouts may not work.args
object. The first submitted command runs independently, but additional
commands from that prompt will fail until the code is corrected.flowchart LR
A["Identify TeamCity version"] --> B{"Patched release?"}
B -- "No" --> C["Upgrade to 2025.11.7 / 2026.1.3+"]
B -- "Upgrade blocked" --> D["Apply JetBrains security patch plugin"]
C --> E["Restrict access to trusted networks or VPN"]
D --> E
E --> F["Review logs, credentials, artifacts, and pipelines"]2025.11.7, 2026.1.3, or a newer
supported release.This code is provided for security research, validation, and defensive testing in environments you own or are explicitly authorized to assess. You are responsible for complying with applicable laws, contracts, and rules of engagement. The author and contributors accept no liability for unauthorized use or resulting damage.
