DEV Community

Anoymask
Anoymask

Posted on Edited on

TeamCity CVE-2026-63077: Unauthenticated RCE Exploited in Ransomware Campaigns

#security #threatintel

1. Basic Information

2. Quick Summary

CVE-2026-63077 in the TeamCity agent polling process leads to unauthenticated remote code execution. In addition to active exploitation confirmed by JetBrains, CISA's KEV catalog lists its use in ransomware activity as known.

3. Attack Flow

This describes the mechanism explained in public sources. Distinctions between researcher verification, implementation analysis, and actual exploitation are covered in "Exploitation Assessment".

From Agent Polling to Pre-Authentication RCE

  1. An attacker sends a crafted request to an unpatched TeamCity server.
  2. Exploiting a vulnerability in the agent polling process, OS commands can be executed with the privileges of the TeamCity server process.
  3. Inference: Depending on assigned privileges, this may affect source code, configurations, credentials, build artifacts, and deployment targets.
  4. While CISA has recorded its use in ransomware activity, specific pathways leading from TeamCity compromise to file encryption have not been publicly disclosed.

4. Attacker Position and Execution Location

  • An unauthenticated attacker with network reachability to the TeamCity server's HTTP(S) interface. In addition to internet exposure, attention should be paid to reachability from compromised internal networks.
  • Subsequent commands execute with the privileges of the TeamCity server process.

5. Victim and Administrator Perspective

Victims

  • This vulnerability does not require user interaction. Unexpected changes in builds or artifacts may appear later.

Administrators

  • Check for anomalies in agent polling, associated exceptions, suspicious agent names starting with "scan", and server child processes or modifications. Do not determine the trial time solely from agent display timestamps.

6. Success and Failure Conditions

Success Conditions

  • HTTP(S) reachability to the target process on an unpatched TeamCity server.
  • Crafted input handled by the vulnerable polling process. Subsequent impact depends on server process privileges and network destinations.

Failure Conditions and Risk Mitigation

  • Update to the corresponding patched versions: 2025.11.7, 2026.1.3, or later versions containing this fix.
  • If immediate updates are not possible, review the corresponding versions and procedures to deploy the official security patch plugin, and restrict connection sources to trusted administrative and build networks.
  • Isolate the TeamCity server from build agents, minimizing server privileges and accessible secrets.

7. What Happens Upon Success

  • Commands execute with the privileges of the TeamCity server process.
  • Inference: This may lead to tampering with or lateral movement across source code, credentials, build artifacts, and deployment targets.
  • Although use in ransomware activity has been confirmed, evidence of successful encryption in specific environments has not been published.

8. Observable Logs

This section includes perspectives for internal investigation and detection. It does not imply that all items were observed in public incidents.

Email

  • The published initial intrusion vector is TeamCity HTTP(S). There is no basis to attribute the attack to email origins.

Proxy, SWG, and DNS

  • Correlate polling request sources and timestamps with TeamCity errors or outbound connections.

Endpoint and EDR

  • Check for TeamCity child processes, suspicious files, and shell or script executions.

Authentication and IdP

  • Inspect build and deployment tokens, service accounts, and subsequent authentication at destination systems.

SaaS and Cloud

  • Review audit logs for changes to agent registrations, build configurations, build artifacts, and credential settings.

Network

  • Inspect internal host discovery, remote connections, and outbound traffic originating from the server.

9. Exploitation Assessment

Scope Confirmable via Public Information

  • Initial Execution Confirmed: Public information: JetBrains reports active exploitation of this vulnerability. Specific commands executed and results in individual environments are unpublished. (Scope: Vendor-reported exploitation status.)

Internal Evaluation Criteria

  • Criteria for Subsequent Compromise: Evaluation criteria: Confirm unauthorized build modifications, credential usage, lateral movement, or encryption using respective operational logs. The presence of a KEV entry alone does not confirm individual encryption success. (Scope: Internal subsequent impact.)

10. Investigation Playbook

The following are proposed investigation and response measures based on public information.

Investigation Starting Point

  • Start from related exceptions, suspicious agents, and server process anomalies.

Initial Verification

  • Verify running versions, application status of official patch plugins, HTTP(S) connection sources, and the duration of public exposure prior to patching.

Endpoint and Server

  • Preserve TeamCity logs, agent information, processes, files, and build history.

Authentication and Cloud

  • Review build and deployment credentials accessible from the server and audit logs of their usage destinations.

Subsequent Operations

  • Inspect for evidence of source or artifact modification, lateral movement, additional payloads, destruction, or encryption.

Containment

  • Restrict connection sources and apply patches. If compromise is suspected, isolate, recover, and rotate exposed credentials.

Judgment Categories

  • Evaluate exceptions, agent registrations, code execution, artifact tampering, and ransomware activity separately.

11. Defense and Detection Ideas

The following are proposed investigation and response measures based on public information.

Single Event

  • Detect related exceptions and suspicious agent names. Distinguish block logs from patched environments.

Time-Series Correlation

  • Correlate polling requests, exceptions, child processes, and build or configuration changes within the same timeline.

Threat Hunting

  • Target the pre-patch public exposure window to investigate vendor-indicated exceptions, agents starting with "scan", and unknown executions.

Log Limitations

  • Exceptions alone cannot distinguish between attempts and compromises. Cross-reference agent display timestamps with request log times.

Prioritized Countermeasures

  • Prioritize patch application, connection restriction, server-agent separation, and pre-patch compromise investigations.

12. Facts / Inference / Hypothesis

Facts

  • CVE-2026-63077 is a vulnerability involving deserialization of untrusted data. Unauthenticated attackers reaching TeamCity via HTTP(S) can execute OS commands with server process privileges through the agent polling process.
  • Patched versions are 2025.11.7 and 2026.1.3. JetBrains published active exploitation and investigation clues on August 7, 2026. TeamCity Cloud has been addressed.
  • For environments unable to immediately update, a security patch plugin mitigating this CVE is also provided for versions 2017.1 and later. It does not replace updating the entire product.
  • Official CISA KEV data lists its use in ransomware activity as known. The September 23 update was reported by BleepingComputer, but specific encryption processes, threat actors, and victim organizations have not been made public.
  • According to JetBrains guidance, ConversionException and suspicious agent names are investigative clues. ForbiddenClassException in patched environments may indicate blocked attempts, and exceptions alone do not confirm successful compromise.

Inference

  • CI server compromise may propagate to other environments via build credentials, source code, artifacts, and deployment tokens. Unauthorized operations prior to patching must be investigated concurrently with updates.

Hypothesis

No additional hypotheses. Unconfirmed items are documented in "Unknowns and Further Investigation".

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (Confidence: high): The vector exploiting reachable TeamCity polling processes.
  • T1059 Command and Scripting Interpreter (Confidence: medium): Pre-authentication OS command execution is the impact of the vulnerability. Specific interpreters or subsequent commands are unpublished.

14. Unknowns and Further Investigation

  • Ransomware operators, victim organizations, and execution payloads.
  • Specific paths leading from TeamCity compromise to subsequent lateral movement or ransomware execution.
  • Actual impact scope on credentials, artifacts, and deployment targets.

15. Impact on SOCs and Organizations

Update on-premises TeamCity to patched versions and restrict connection sources. Starting from exception logs, investigate server execution history, build and artifact modifications, and subsequent credential usage. Being patched is distinct from having no past compromise.

16. Role-Based Summary

  • SOC: Correlate polling requests, exceptions, suspicious agents, child processes, and credential usage.
  • Administrators: Apply patches, restrict connection sources, and rotate build and deployment credentials suspected of exposure during investigations.
  • Users: Follow CI administrator guidance and report suspicious builds or distributed artifacts.

Top comments (0)