CVE-2026-63077: Additional Guidance Following Reports of Active Exploitation

Daniel Gallo

This post is a follow-up to our July 27, 2026, announcement about CVE-2026-63077.

Summary

• Since our initial announcement on July 27, 2026, we have received reports of active exploitation, as well as attempted exploitation, targeting unpatched TeamCity servers.
• We strongly recommend that customers who have not yet updated to TeamCity 2025.11.7 or 2026.1.3, or installed the security patch plugin, do so immediately.
• TeamCity Cloud customers are not required to take any action.
• Additional technical guidance for investigating potential exploitation is provided below.

What has changed since our initial announcement

Since our initial announcement on July 27, 2026, we have received reports of active exploitation, as well as attempted exploitation, targeting unpatched TeamCity servers.

Before these reports were received, we had already investigated the issue, developed mitigations, and made fixes available to all supported customers as part of our standard security response process.

If you have not yet applied one of the available mitigation options below, we strongly recommend doing so immediately to help protect your TeamCity environment.

What you should do

CVE-2026-63077 has been fixed in TeamCity 2025.11.7 and 2026.1.3. Customers should update to one of these versions as soon as possible.

If you are unable to update immediately, a security patch plugin is available for TeamCity 2017.1 and later.

For complete update and mitigation instructions, including information about installing the security patch plugin, please refer to our original announcement.

Important: The security patch plugin addresses only CVE-2026-63077. We always recommend upgrading your server to the latest version to benefit from other security updates.

TeamCity Cloud customers do not need to take any action, as the necessary mitigations have already been applied.

Technical details

CVE-2026-63077 can be exploited without authentication. An unauthenticated attacker with HTTP(S) access to a vulnerable TeamCity server could exploit the vulnerability via the TeamCity agent polling protocol to execute arbitrary operating system commands with the privileges of the TeamCity server process.

Depending on the privileges granted to the TeamCity server process, a successful exploit could expose TeamCity data, configurations, and stored credentials, modify server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines.

As a precaution, administrators may wish to review their TeamCity server logs for occurrences of the following message:

com.thoughtworks.xstream.converters.ConversionException

While the above message alone does not confirm exploitation, it may indicate an attempted or successful exploit and warrants further investigation. If you have any questions or would like assistance interpreting your logs, please contact the TeamCity Support team by submitting a ticket.

If you have already installed the security patch plugin or upgraded to a fixed version, you may also wish to review the TeamCity server logs for occurrences of the following message:

com.thoughtworks.xstream.security.ForbiddenClassException

This message may indicate that an attempt was made to exploit the vulnerability after your server had been patched. In this case, the message indicates the attempt was successfully blocked by the security patch or fixed TeamCity version.

Administrators may also wish to review the list of unauthorized build agents for unexpected entries, particularly agents with names beginning with scan. The presence of such agents may indicate an attempted exploit on servers whose URL was reachable by an attacker. These agents can be safely removed. Please note that the date shown for an unauthorized agent does not necessarily indicate when the exploit attempt occurred. Instead, you should rely on the timestamps of the relevant log messages when determining when an attempt may have taken place. If you have any questions or would like assistance interpreting your logs or investigating these indicators, please contact the TeamCity Support team by submitting a ticket.

Additional security recommendations

If your TeamCity server is publicly accessible over the internet and you are unable to apply one of the available mitigation options immediately, we strongly recommend temporarily restricting external access until you have done so.

As a longer-term security best practice, we recommend limiting network access to TeamCity servers to trusted networks wherever possible and running the TeamCity server with the minimum operating system privileges required for normal operation.

Internet-facing TeamCity servers should also consider requiring connections through a VPN or implementing an additional security layer to help prevent unauthorized access.

TeamCity servers should also run on dedicated hosts separate from build agents, as described in our documentation.

Support

If you have any questions about this issue or encounter problems updating your server or installing the security patch plugin, please contact the TeamCity Support team by submitting a ticket.