CVE-2026-63077: JetBrains TeamCity Deserialization Bug Added to CISA KEV — Detection and Remediation Guide

On August 5, 2026, CISA added CVE-2026-63077 — a deserialization of untrusted data vulnerability in JetBrains TeamCity — to its Known Exploited Vulnerabilities (KEV) Catalog. That designation is not a severity score or a theoretical risk rating. It is a statement of fact: this vulnerability is being actively exploited in the wild.

For defenders, the affected product matters as much as the bug class. TeamCity is a continuous integration and continuous delivery (CI/CD) server. It sits at the center of the software development lifecycle, holds source code credentials, artifact signing keys, deployment tokens, and pipeline secrets, and it talks to everything — source control, artifact repositories, production infrastructure. A compromised build server is not a single-host incident; it is a potential supply-chain event. We have seen this play out repeatedly: threat actors, including nation-state operators, consistently prioritize CI/CD infrastructure because one foothold yields downstream access to every system the pipeline touches.

Under Binding Operational Directive (BOD) 26-04, all Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities on CISA's mandated timeline. But the directive's logic applies to every organization running TeamCity: if a vulnerability is being exploited today, it moves to the front of your patch queue — ahead of anything with a higher CVSS score that is not.

This post breaks down what we know about CVE-2026-63077, how to hunt for exploitation and post-exploitation behavior in your environment, and exactly what to do about it.

Technical Analysis

What We Know

• CVE: CVE-2026-63077
• Product: JetBrains TeamCity (on-premises build server)
• Vulnerability class: Deserialization of Untrusted Data (CWE-502)
• Exploitation status: Confirmed active exploitation; listed in the CISA KEV Catalog
• Regulatory driver: BOD 26-04 requires FCEB remediation per the KEV due date

Because the CISA alert does not enumerate affected build ranges or a CVSS score, pull those specifics directly from the JetBrains security advisory before scoping your exposure — do not assume your version is unaffected because it is "recent." JetBrains typically discloses fixed build numbers in its security bulletins, and those build numbers are what you validate against, not major.minor marketing versions.

Why Deserialization in a CI/CD Server Is a Critical Bug Class

Deserialization vulnerabilities occur when an application reconstructs objects from attacker-controlled input without adequately validating the object graph. In Java-based platforms like TeamCity, a reachable deserialization sink can allow an attacker to instantiate arbitrary classes — and with the right gadget chain present on the classpath, that converts directly to remote code execution. No memory corruption gymnastics required; the attacker is abusing intended application behavior.

From a defender's perspective, the attack chain for a bug of this class in TeamCity typically looks like this:

1. Initial access: The attacker sends a crafted serialized payload to a reachable TeamCity endpoint. Depending on the affected component, this may be unauthenticated or require low-privileged access — check the vendor advisory for the authentication requirement, because it changes your exposure math dramatically for internet-facing instances.
2. Code execution: The payload executes in the context of the TeamCity server process — a Java process running under a service account (often SYSTEM on Windows or a dedicated teamcity user on Linux). That account frequently has read access to build configurations, environment variables, and the TeamCity data directory where secrets and artifacts live.
3. Post-exploitation: Expect one or more of the following: a webshell dropped into the TeamCity web application directory, child processes spawned from the Java process (command shells, scripting engines), credential harvesting from build agent configurations, and lateral movement using pipeline credentials.

Why CI/CD Servers Draw Sophisticated Attention

TeamCity sits in a trust position that few other servers occupy. Build agents authenticate to it, it authenticates to source control and artifact stores, and pipelines often deploy directly into production. An attacker who owns the build server can:

• Inject malicious code into build artifacts before signing
• Steal cloud deployment credentials, SSH keys, and API tokens from build configurations
• Pivot to developer workstations via build agent tasking
• Modify build scripts to persist across reimaging

Treat any confirmed exploitation on a TeamCity host as an incident-response event, not a patching ticket. Assume credential exposure and audit everything the server could reach.

Detection & Response

The detections below are grounded in the observable behaviors of this exploit class: a Java web application process executing attacker payloads, spawning shell children, and writing webshells to its web root. These are high-fidelity signals — legitimate TeamCity servers do not normally spawn cmd.exe, powershell.exe, or interactive shells from the server JVM.

Sigma Rules

---
title: TeamCity Server Process Spawning Shell or Script Interpreter
id: 3f8a2c91-7b44-4e1d-a9c2-6d5e8f0a1b3c
status: experimental
description: Detects the TeamCity Java server process spawning command shells or script interpreters, consistent with post-exploitation activity following deserialization RCE such as CVE-2026-63077.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/05/cisa-adds-one-known-exploited-vulnerability-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\java.exe'
    ParentCommandLine|contains:
      - 'TeamCity'
      - 'teamcity-server'
      - 'catalina'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Build steps configured to run on the server itself rather than on build agents (uncommon and discouraged)
level: high
---
title: Webshell or JSP File Written to TeamCity Web Application Directory
id: 9c1d4e72-2a6b-4f38-b7d1-8e3c5a90f246
status: experimental
description: Detects creation of JSP or script files in TeamCity web application directories, a common persistence mechanism after remote code execution on Java application servers such as the CVE-2026-63077 deserialization exploit.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/05/cisa-adds-one-known-exploited-vulnerability-catalog
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_creation
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\TeamCity\webapps\'
      - '\TeamCity\work\Catalina\'
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.jspf'
      - '.war'
      - '.aspx'
      - '.php'
  filter_deploy:
    Image|endswith:
      - '\java.exe'
    TargetFilename|contains: '\webapps\ROOT\WEB-INF\'
  condition: selection and not filter_deploy
falsepositives:
  - Legitimate TeamCity upgrades or plugin deployments (correlate with change windows)
level: high
---
title: Suspicious Outbound Network Connection from TeamCity Java Process
id: 5e7b9a34-1c8d-4f26-a3b9-2d4e6f80c157
status: experimental
description: Detects the TeamCity server JVM making outbound connections to uncommon external destinations, which may indicate payload retrieval or C2 following exploitation of CVE-2026-63077.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/05/cisa-adds-one-known-exploited-vulnerability-catalog
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\java.exe'
    CommandLine|contains:
      - 'TeamCity'
      - 'teamcity-server'
    Initiated: 'true'
  filter_known:
    DestinationHostname|contains:
      - 'jetbrains.com'
      - 'plugins.jetbrains.com'
      - 'download.jetbrains.com'
      - 'nuget.org'
      - 'github.com'
      - 'maven.org'
      - 'sonatype.org'
  condition: selection and not filter_known
falsepositives:
  - Outbound connections to internal artifact repositories, source control, or package feeds (tune the filter to your environment)
level: medium

Two tuning notes from the field: First, the CommandLine|contains: 'catalina' branch in the first rule catches Tomcat-bundled TeamCity deployments where the JVM command line references Catalina home rather than "TeamCity" literally. Second, the outbound connection rule will only be quiet if you maintain an accurate allowlist of your internal package feeds and artifact stores — spend the 20 minutes to build that list, because a JVM beaconing to an unknown external host is exactly the alert you want firing at 2 a.m.

KQL (Microsoft Sentinel / Defender)

This query hunts for shell spawns under the TeamCity JVM across both Defender for Endpoint telemetry and Sysmon-ingested SecurityEvent (4688) data. Run it over at least the last 30 days — KEV additions often lag initial exploitation by weeks, and you need to know whether you were hit before the public disclosure.

// Hunt: TeamCity server JVM spawning shells or LOLBins (CVE-2026-63077 post-exploitation)
let lookback = 30d;
let teamcityParents = dynamic(["\\java.exe"]);
let suspiciousChildren = dynamic(["\\cmd.exe","\\powershell.exe","\\pwsh.exe","\\wscript.exe","\\cscript.exe","\\rundll32.exe","\\regsvr32.exe","\\mshta.exe","\\whoami.exe","\\net.exe","\\curl.exe","\\certutil.exe","\\bitsadmin.exe"]);
let mdeResults =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName =~ "java.exe"
    | where InitiatingProcessCommandLine has_any ("TeamCity","teamcity-server","catalina")
    | where FileName has_any ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","rundll32.exe","regsvr32.exe","mshta.exe","whoami.exe","net.exe","curl.exe","certutil.exe","bitsadmin.exe")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, SHA256, ReportId
    | extend Source = "MDE";
let wineventResults =
    SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 4688
    | where ParentProcessName has_any (teamcityParents)
    | where NewProcessName has_any (suspiciousChildren)
    | where CommandLine has_any ("whoami","net ","powershell","-enc","invoke-", "downloadstring","curl ","bitsadmin","certutil") or CommandLine == ""
    | project TimeGenerated, Computer, NewProcessName, CommandLine, ParentProcessName, SubjectAccount, SubjectUserName
    | extend Source = "SecurityEvent";
union mdeResults, wineventResults
| order by TimeGenerated desc

A companion hunt worth running on network telemetry — inbound connections to TeamCity's default HTTP port (8111) from source addresses outside your expected developer/CI ranges:

// Hunt: Inbound connections to TeamCity server (default port 8111) from unexpected sources
let lookback = 14d;
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DestinationPort == 8111
| where ipv4_is_private(SourceIP) == false or SourceIP !startswith "10." // tune to your dev/VPN ranges
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), ConnectionCount=count()
  by SourceIP, DestinationIP, DestinationPort, DeviceVendor, DeviceProduct
| order by ConnectionCount desc

If TeamCity is ingested via Syslog from Linux hosts, swap in the Syslog table and filter on process name java with teamcity in the command line for the child-process hunt.

Velociraptor VQL

This artifact combines three quick triage checks on a suspected TeamCity host: suspicious children of the JVM, recent JSP/script writes in the web application directories, and the listening socket on 8111 to confirm exposure.

-- Triage artifact: TeamCity CVE-2026-63077 post-exploitation indicators
-- 1. Live processes: shells or LOLBins parented to the TeamCity JVM
SELECT Pid, PPid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)cmd|powershell|pwsh|wscript|cscript|rundll32|mshta|sh$|bash$|dash$')
   AND PPid IN (
       SELECT Pid FROM pslist()
       WHERE CommandLine =~ '(?i)teamcity|catalina' AND Name =~ '(?i)java'
   )

-- 2. Recent script/webshell writes under TeamCity web application directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
    'C:\\TeamCity\\webapps\\**\\*.jsp',
    'C:\\TeamCity\\webapps\\**\\*.jspx',
    'C:\\TeamCity\\work\\Catalina\\**\\*.jsp',
    '/opt/teamcity/webapps/**/*.jsp',
    '/opt/teamcity/work/Catalina/**/*.jsp'
])
WHERE Mtime > now() - 60*60*24*30
ORDER BY Mtime DESC

-- 3. Confirm TeamCity listener exposure (default port 8111)
SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE LocalPort == 8111 OR Name =~ '(?i)java'

On any host where query 1 or 2 returns hits, isolate the server from the network (do not power it off — preserve memory), capture a triage image, and pivot to IR. Webshells are frequently deleted after use; also review the TeamCity work/Catalina and logs directories and check for newly created local accounts and unauthorized build agent registrations in the TeamCity admin console.

Verification and Hardening Script

Run this on Windows TeamCity servers to validate the installed build, inventory suspicious web-root artifacts, and enumerate risky process ancestry. It is read-only — it changes nothing, so it is safe to run during business hours.

# TeamCity CVE-2026-63077 verification and triage script - run elevated on the TeamCity server
# READ-ONLY: performs inventory and validation only, no changes made

$report = @{}

# 1. Identify TeamCity installation and version
$tcService = Get-Service -Name "TeamCity*" -ErrorAction SilentlyContinue
$tcPaths = @("C:\TeamCity", "D:\TeamCity", "C:\TeamCity\buildServer") | Where-Object { Test-Path $_ }
$versionFile = Get-ChildItem -Path $tcPaths -Recurse -Filter "version.properties" -ErrorAction SilentlyContinue | Select-Object -First 1
if ($versionFile) {
    $report['TeamCityVersion'] = Get-Content $versionFile.FullName -Raw
    Write-Host "[+] TeamCity version info:`n$($report['TeamCityVersion'])"
    Write-Host "[!] ACTION: Compare this build number against the fixed build listed in the JetBrains security advisory for CVE-2026-63077"
} else {
    Write-Host "[-] TeamCity installation not found at standard paths - verify install location"
}

# 2. Inventory JSP/script files in web roots modified in the last 30 days
Write-Host "`n[+] Scanning web application directories for recently modified script files..."
$webDirs = Get-ChildItem -Path $tcPaths -Recurse -Directory -ErrorAction SilentlyContinue |
    Where-Object { $_.FullName -match "webapps|work\\Catalina" }
foreach ($dir in $webDirs) {
    Get-ChildItem -Path $dir.FullName -Recurse -Include *.jsp,*.jspx,*.jspf,*.war,*.aspx,*.php -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
        Select-Object FullName, LastWriteTime, Length
}

# 3. Find shells/LOLBins parented to the TeamCity JVM currently in memory
Write-Host "`n[+] Checking for suspicious child processes of the TeamCity JVM..."
$javaProcs = Get-CimInstance Win32_Process -Filter "Name='java.exe'" |
    Where-Object { $_.CommandLine -match "TeamCity|teamcity-server|catalina" }
$suspicious = "cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","rundll32.exe","regsvr32.exe","mshta.exe","net.exe","whoami.exe"
foreach ($j in $javaProcs) {
    Get-CimInstance Win32_Process |
        Where-Object { $_.ParentProcessId -eq $j.ProcessId -and $suspicious -contains $_.Name } |
        Select-Object Name, ProcessId, CommandLine, CreationDate
}

# 4. Confirm listening exposure on default TeamCity port
Write-Host "`n[+] TeamCity network listeners (default port 8111):"
Get-NetTCPConnection -State Listen -LocalPort 8111 -ErrorAction SilentlyContinue |
    Select-Object LocalAddress, LocalPort, OwningProcess

# 5. Recent local account creation (post-exploitation persistence check)
Write-Host "`n[+] Local accounts created in the last 30 days:"
Get-LocalUser | Where-Object { $_.PasswordLastSet -gt (Get-Date).AddDays(-30) } |
    Select-Object Name, Enabled, PasswordLastSet

Write-Host "`n[=] Triage complete. Any hits in sections 2, 3, or 5 warrant escalation to IR before remediation."

For Linux-hosted TeamCity:

# Quick Linux triage for TeamCity hosts
# 1. Identify running TeamCity JVM and version
ps -eo pid,cmd | grep -i [j]ava | grep -i -E 'teamcity|catalina'
cat /opt/teamcity/webapps/ROOT/WEB-INF/classes/version.properties 2>/dev/null

# 2. Recently modified JSP/script files in web roots (last 30 days)
find /opt/teamcity/webapps /opt/teamcity/work -type f \( -name '*.jsp' -o -name '*.jspx' -o -name '*.war' -o -name '*.php' \) -mtime -30 -ls 2>/dev/null

# 3. Shells parented to the TeamCity JVM
TC_PID=$(pgrep -f 'teamcity|catalina' | head -1)
[ -n "$TC_PID" ] && ps --ppid "$TC_PID" -o pid,ppid,user,cmd

# 4. Listener exposure
ss -tlnp | grep -E ':8111'

Remediation

Act on the following in order. Do not treat steps 1 and 2 as interchangeable — patching a compromised host without investigating it leaves the attacker inside.

1. Patch immediately. Upgrade TeamCity to the fixed build specified in the JetBrains security advisory for CVE-2026-63077. Verify the exact affected and fixed build numbers from the vendor bulletin — do not assume. JetBrains advisories are published at the JetBrains security bulletins page (https://www.jetbrains.com/security/) and the fixed-version detail is also linked from the CISA KEV entry. FCEB agencies: remediate by the due date in the KEV Catalog per BOD 26-04. For all other organizations, my recommendation is a 72-hour SLA on actively exploited vulnerabilities in internet-adjacent infrastructure — and that clock started when CISA published, not when you read this.

2. Hunt before and after patching. Run the detections above across a minimum 30-day lookback. Confirmed exploitation is why this CVE is in the KEV — if you have an internet-reachable or broadly reachable TeamCity instance, assume you may already be a victim until telemetry proves otherwise.

3. Remove TeamCity from the public internet. A build server has no legitimate reason to be directly internet-facing. If yours is, put it behind a VPN, identity-aware proxy, or IP allowlist immediately. Review firewall rules and your external attack surface inventory — every forgotten TeamCity instance in a cloud account is an open door right now.

4. Rotate credentials if compromise is suspected or confirmed. This includes: source control access tokens, artifact repository credentials, cloud deployment keys, service account passwords used by build agents, and any secrets stored in build configuration environment variables. Assume anything the TeamCity service account could read is exposed.

5. Review build agent registrations and project configurations. In the TeamCity admin console, audit for unauthorized agents, new administrator accounts, modified VCS roots, and changes to build step definitions over the past 60 days. Attackers who persist in CI/CD frequently do so by editing the pipeline itself — that survives a server rebuild.

6. Harden the service account. Run TeamCity under a least-privilege dedicated account, not SYSTEM or root. Restrict its ability to write outside the TeamCity directories and deny outbound network access except to required destinations (source control, artifact stores, JetBrains update endpoints).

7. Log and monitor the tier. Forward TeamCity authentication logs, the server JVM process telemetry, and web access logs to your SIEM. CI/CD infrastructure belongs in the same monitoring tier as your identity systems — that is the access an attacker is buying with this exploit.

8. Update your vulnerability management SLA. If KEV-listed vulnerabilities are not already a distinct, fastest-path lane in your patch management process, make them one. BOD 26-04 formalizes this for federal agencies; the private sector should treat the KEV as the floor, not the ceiling.

The uncomfortable truth about CI/CD compromise is that the blast radius is defined by trust, not network segmentation. Patch fast, hunt hard, and if you find evidence of exploitation, scope the incident by what the build server could reach — not by what you can prove the attacker touched.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub