A deep technical analysis of CVE-2026-63077, a critical unauthenticated RCE vulnerability in JetBrains TeamCity. The root cause is an unsafe deserialization flaw in the agent polling protocol endpoint: TeamCity's XStreamHolder adds classes to an allowlist but fails to clear XStream's default type permissions (Map, Throwable hierarchies), leaving a gadget chain exploitable. The exploit registers a fake agent session, sends a crafted XML payload to /app/agents/v1/commands/error, chains HSQLMetadataStorage$SchemaMismatchException → BasicDataSource → HSQLDB → writes a .jspws webshell, then executes arbitrary OS commands. The patch (version 2026.1.3) fixes this by prepending NoTypePermission.NONE before populating the allowlist. CISA added this CVE to its KEV catalog confirming active exploitation. IOCs and a proof-of-concept script are provided.
Questions this post answers
What is the root cause of CVE-2026-63077 in JetBrains TeamCity and how does the exploit work?
The root cause is that TeamCity's XStreamHolder adds an allowlist of classes but never clears XStream's default type permissions, which already permit broad hierarchies including Map and Throwable. An attacker registers a fake agent session (unauthenticated), then POSTs a crafted XML gadget chain to /app/agents/v1/commands/error. The chain uses HSQLMetadataStorage$SchemaMismatchException → BasicDataSource → HSQLDB SCRIPT command to write a .jspws webshell, achieving RCE. Teams running TeamCity in CI/CD pipelines track critical deserialization CVEs like this on daily.dev before exploitation reaches their infrastructure.
How does the patch in JetBrains TeamCity 2026.1.3 fix the unsafe deserialization vulnerability CVE-2026-63077?
Version 2026.1.3 adds a call to xStream.addPermission(NoTypePermission.NONE) before populating the TeamCity allowlist in setupSecurityIfNeeded(). This clears all of XStream's default permissions — including the Map and Throwable hierarchies — making the allowlist exclusively deny-by-default. The new behavior is controlled by the teamcity.xstream.whiteList.forced property, which defaults to true on patched servers. Developers upgrading TeamCity across environments can follow patch rollout coverage for CVEs like this on daily.dev.
What are the indicators of compromise for CVE-2026-63077 exploitation in JetBrains TeamCity logs?
On an exploited system, teamcity-server.log contains XStream ConversionException traces referencing the path /linked-hash-map/entry[3]/set/org.apache.commons.collections.keyvalue.TiedMapEntry and a POST to /app/agents/v1/commands/error with no auth. The javaLogging file shows an org.hsqldb.HsqlException referencing a .jspws file path in the webroot, revealing the webshell write attempt. Security engineers monitoring CI/CD platforms for active exploitation find CVE coverage and IOC discussions on daily.dev.