{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "TeamCity agent polling protocol: POST /app/agents/v1/register + POST /app/agents/v1/commands/error (unauthenticated XStream deserialization in Error.fromXml)",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "docker",
    "jetbrains/teamcity-server:2025.11.6-linux (vulnerable)",
    "jetbrains/teamcity-server:2025.11.7-linux (fixed)",
    "tomcat-9",
    "hsqldb",
    "openjdk-21"
  ],
  "target_identity": {
    "repository_url": "https://hub.docker.com/r/jetbrains/teamcity-server",
    "commit_sha": null,
    "target_digest": "sha256:a435d848808ac6f9b4a8b0970e29a1b8723ed6cc28f309e6df44f334b4cb7416",
    "runtime_digest": "sha256:d3875b0d20207d161c0424c923f809109e03e2cf893cba178f28a9032ada56d8",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "logs/reproduction_steps.log",
    "logs/teamcity_vuln_server.log",
    "logs/teamcity_fixed_server.log",
    "logs/exploit_vulnerable.log",
    "logs/exploit_fixed.log",
    "repro/payload_vulnerable.xml",
    "repro/payload_fixed.xml",
    "repro/jsp_response_vulnerable.txt",
    "repro/marker_vulnerable.txt"
  ],
  "notes": "CVE-2026-63077 confirmed: unauthenticated XStream deserialization RCE via agent polling protocol on TeamCity 2025.11.6; blocked with ForbiddenClassException on 2025.11.7"
}