--- title: Rapid7 | daily.dev description: A deep technical analysis of CVE-2026-63077, a critical unauthenticated RCE vulnerability in JetBrains TeamCity. The root cause is an unsafe deserialization... canonical: https://daily.dev/posts/rapid7-kcfsivs9j twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rapid7 | daily.dev og:description: A deep technical analysis of CVE-2026-63077, a critical unauthenticated RCE vulnerability in JetBrains TeamCity. The root cause is an unsafe deserialization... og:url: https://daily.dev/posts/rapid7-kcfsivs9j og:image: https://api.daily.dev/og/posts/kcFsIVs9j.png og:image:alt: Rapid7 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rapid7 **[Rapid7 Cybersecurity Blog](https://daily.dev/sources/rapid7-blog)** · 16 min read · 0 upvotes · 0 comments ## Summary A deep technical analysis of CVE-2026-63077, a critical unauthenticated RCE vulnerability in JetBrains TeamCity. The root cause is an unsafe deserialization flaw in the agent polling protocol endpoint: TeamCity's XStreamHolder adds classes to an allowlist but fails to clear XStream's default type permissions (Map, Throwable hierarchies), leaving a gadget chain exploitable. The exploit registers a fake agent session, sends a crafted XML payload to /app/agents/v1/commands/error, chains HSQLMetadataStorage$SchemaMismatchException → BasicDataSource → HSQLDB → writes a .jspws webshell, then executes arbitrary OS commands. The patch (version 2026.1.3) fixes this by prepending NoTypePermission.NONE before populating the allowlist. CISA added this CVE to its KEV catalog confirming active exploitation. IOCs and a proof-of-concept script are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the root cause of CVE-2026-63077 in JetBrains TeamCity and how does the exploit work? The root cause is that TeamCity's XStreamHolder adds an allowlist of classes but never clears XStream's default type permissions, which already permit broad hierarchies including Map and Throwable. An attacker registers a fake agent session (unauthenticated), then POSTs a crafted XML gadget chain to /app/agents/v1/commands/error. The chain uses HSQLMetadataStorage$SchemaMismatchException → BasicDataSource → HSQLDB SCRIPT command to write a .jspws webshell, achieving RCE. _Teams running TeamCity in CI/CD pipelines track critical deserialization CVEs like this on daily.dev before exploitation reaches their infrastructure._ ### How does the patch in JetBrains TeamCity 2026.1.3 fix the unsafe deserialization vulnerability CVE-2026-63077? Version 2026.1.3 adds a call to xStream.addPermission(NoTypePermission.NONE) before populating the TeamCity allowlist in setupSecurityIfNeeded(). This clears all of XStream's default permissions — including the Map and Throwable hierarchies — making the allowlist exclusively deny-by-default. The new behavior is controlled by the teamcity.xstream.whiteList.forced property, which defaults to true on patched servers. _Developers upgrading TeamCity across environments can follow patch rollout coverage for CVEs like this on daily.dev._ ### What are the indicators of compromise for CVE-2026-63077 exploitation in JetBrains TeamCity logs? On an exploited system, teamcity-server.log contains XStream ConversionException traces referencing the path /linked-hash-map/entry[3]/set/org.apache.commons.collections.keyvalue.TiedMapEntry and a POST to /app/agents/v1/commands/error with no auth. The javaLogging file shows an org.hsqldb.HsqlException referencing a .jspws file path in the webroot, revealing the webshell write attempt. _Security engineers monitoring CI/CD platforms for active exploitation find CVE coverage and IOC discussions on daily.dev._ ## Similar posts on daily.dev - [CISA: Ransomware gangs now exploiting critical TeamCity flaw](https://daily.dev/posts/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw-ivphb8400) · BleepingComputer · 1 upvotes · 0 comments - [High-Severity Security Issue Affecting TeamCity On-Premises \(CVE-2026-44413\) – Update to 2026.1 Now](https://daily.dev/posts/high-severity-security-issue-affecting-teamcity-on-premises-cve-2026-44413-update-to-2026-1-now-dryw37woz) · JetBrains · 0 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#cicd](https://daily.dev/tags/cicd) [View this post on daily.dev](https://daily.dev/posts/rapid7-kcfsivs9j) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rapid7","url":"https://daily.dev/posts/rapid7-kcfsivs9j","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rapid7-kcfsivs9j"},"datePublished":"2026-08-07T15:49:56.734Z","dateModified":"2026-08-07T15:51:33.470Z","description":"A deep technical analysis of CVE-2026-63077, a critical unauthenticated RCE vulnerability in JetBrains TeamCity. The root cause is an unsafe deserialization...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a772c2654395fbfc9085d4a2b564c97?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a772c2654395fbfc9085d4a2b564c97?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Rapid7 Cybersecurity Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Rapid7 Cybersecurity Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/rapid7-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rapid7-kcfsivs9j","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"java,cicd","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rapid7 Cybersecurity Blog","item":"https://daily.dev/sources/rapid7-blog"},{"@type":"ListItem","position":3,"name":"Rapid7"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rapid7-kcfsivs9j#faq","mainEntity":[{"@type":"Question","name":"What is the root cause of CVE-2026-63077 in JetBrains TeamCity and how does the exploit work?","acceptedAnswer":{"@type":"Answer","text":"The root cause is that TeamCity's XStreamHolder adds an allowlist of classes but never clears XStream's default type permissions, which already permit broad hierarchies including Map and Throwable. An attacker registers a fake agent session (unauthenticated), then POSTs a crafted XML gadget chain to /app/agents/v1/commands/error. The chain uses HSQLMetadataStorage$SchemaMismatchException → BasicDataSource → HSQLDB SCRIPT command to write a .jspws webshell, achieving RCE. Teams running TeamCity in CI/CD pipelines track critical deserialization CVEs like this on daily.dev before exploitation reaches their infrastructure."}},{"@type":"Question","name":"How does the patch in JetBrains TeamCity 2026.1.3 fix the unsafe deserialization vulnerability CVE-2026-63077?","acceptedAnswer":{"@type":"Answer","text":"Version 2026.1.3 adds a call to xStream.addPermission(NoTypePermission.NONE) before populating the TeamCity allowlist in setupSecurityIfNeeded(). This clears all of XStream's default permissions — including the Map and Throwable hierarchies — making the allowlist exclusively deny-by-default. The new behavior is controlled by the teamcity.xstream.whiteList.forced property, which defaults to true on patched servers. Developers upgrading TeamCity across environments can follow patch rollout coverage for CVEs like this on daily.dev."}},{"@type":"Question","name":"What are the indicators of compromise for CVE-2026-63077 exploitation in JetBrains TeamCity logs?","acceptedAnswer":{"@type":"Answer","text":"On an exploited system, teamcity-server.log contains XStream ConversionException traces referencing the path /linked-hash-map/entry[3]/set/org.apache.commons.collections.keyvalue.TiedMapEntry and a POST to /app/agents/v1/commands/error with no auth. The javaLogging file shows an org.hsqldb.HsqlException referencing a .jspws file path in the webroot, revealing the webshell write attempt. Security engineers monitoring CI/CD platforms for active exploitation find CVE coverage and IOC discussions on daily.dev."}}]} ```