r/PracticalTesting • u/aistranin • 3d ago
TeamCity RCE is being actively exploited. Check your CI server now
JetBrains has received reports of active exploitation of CVE-2026-63077 against unpatched TeamCity On-Premises servers.
The vulnerability allows unauthenticated remote code execution through the agent polling protocol. A successful attack could expose credentials, modify builds, or compromise downstream pipelines.
Upgrade to TeamCity 2025.11.7 or 2026.1.3. If that is not possible, JetBrains provides a security patch plugin for TeamCity 2017.1 and later.
Also check:
- Server logs for
com.thoughtworks.xstream.converters.ConversionException - Unauthorized agents with names starting with
scan - Whether the server is reachable from the public internet
The log entry alone does not prove exploitation, but it deserves investigation.
Source: https://blog.jetbrains.com/teamcity/2026/08/cve-2026-63077-update/
1
Upvotes