CISA: Critical JetBrains TeamCity Vulnerability Already Under Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has reported that a recently patched vulnerability in on-premise versions of JetBrains TeamCity is already being used in real-world attacks. The flaw in question is CVE-2026-63077, which carries the highest possible severity rating — 9.8 on the CVSS scale.

What it's about

The vulnerability belongs to the class of insecure deserialization of untrusted data. It allows an unauthenticated attacker with access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the server process. According to CISA, exploitation occurs through the agent polling protocol — it is precisely this channel that opens the door to unauthenticated remote code execution.

The specific impact depends on the privileges under which the TeamCity process runs. A successful attack, as described by JetBrains, can expose data, configurations and stored credentials, alter the server's state, and jeopardize the integrity of build artifacts and the associated CI/CD pipelines. In other words, a compromised continuous integration server becomes a convenient entry point into the entire development chain.

What's known about the attacks

Details are still scarce. It is unknown exactly how the vulnerability is being exploited, who is behind the attacks, or their scale. As of publication, JetBrains had not yet updated its advisory with confirmation of active exploitation — the alert about the attacks came from CISA.

What to do

Everyone using on-premise versions of TeamCity is advised to install the updates as soon as possible. For U.S. federal civilian agencies this is no longer a recommendation but an obligation: under directive BOD 26-04, they must give priority to remediating vulnerabilities in the Known Exploited Vulnerabilities (KEV) catalog. The deadline for applying the patch or mitigations for CVE-2026-63077 has been set for August 8, 2026.

Source: The Hacker News