Cybersecurity

TeamCity Flaw Lets Attackers Own Your Build Pipeline

CISA confirms active exploitation of CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity On-Premises. CVSS 9.8, KEV-listed 5 August, FCEB deadline 8 August.

CybersecurityBy Servola Tech Desk2026-08-105 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

TeamCity Flaw Lets Attackers Own Your Build Pipeline

Key takeaways

CVE-2026-63077 carries a CVSS score of 9.8 and gives an unauthenticated attacker full command execution on JetBrains TeamCity On-Premises; CISA confirmed active exploitation and set a federal remediation deadline of 8 August 2026, this past Saturday.
The flaw is a deserialization bug in TeamCity's agent polling protocol, reachable over plain HTTP or HTTPS with no login, and it hands the attacker whatever privileges the TeamCity server process itself runs with.
JetBrains disclosed the flaw and shipped fixes, 2025.11.7 and 2026.1.3, on 27 July 2026; CISA confirmed active exploitation just nine days later, on 5 August, and added it to its Known Exploited Vulnerabilities catalog.
A compromised TeamCity server does not just leak data, it sits where source code becomes shipped software, holding the cloud keys, registry tokens and signing credentials a pipeline uses to deploy under an organization's own name.

A 9.8 in the Server That Builds Your Software

CVE-2026-63077 is a deserialization-of-untrusted-data vulnerability, the class CISA tracks under CWE-502, in JetBrains TeamCity On-Premises, the continuous-integration and continuous-delivery server thousands of European and UK development teams run to compile, test and ship their own code. It carries a CVSS score of 9.8, the near-maximum tier reserved for flaws that need no credentials, no user interaction, and hand the attacker everything at once.

The flaw sits in TeamCity's agent polling protocol, the channel build agents use to check in with the server. An attacker who can reach that channel over HTTP or HTTPS, with no login required, can send a crafted payload that TeamCity deserializes and executes as an operating system command, running with whatever privileges the TeamCity server process itself holds. Every on-premises version shipped is affected; TeamCity Cloud, hosted by JetBrains, was already patched and needs no action from customers.

Nine Days From Disclosure to Confirmed Exploitation

JetBrains published its own advisory on 27 July 2026, crediting the discovery and shipping fixed builds, TeamCity 2025.11.7 and 2026.1.3, along with a security patch plugin covering version 2017.1 onward for teams that cannot upgrade immediately. At the time, JetBrains said it was aware of no active exploitation.

On 5 August 2026, the US Cybersecurity and Infrastructure Security Agency added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, the list CISA reserves for flaws it has confirmed are being used in real attacks, not merely theoretical ones. Under Binding Operational Directive 26-04, US federal civilian agencies had until 8 August 2026, this past Saturday, to patch or disconnect exposed systems. The listing landed the same week CISA confirmed a separate wave of active exploitation against IBM Langflow, N-able N-central and Apache Tomcat, added to the catalog a day earlier on 4 August in a distinct bulletin; different vulnerabilities, different vendors, the same message about how little runway internet-facing infrastructure software gets once a flaw goes public.

A CI/CD Breach Is a Supply-Chain Breach

A typical web server compromise costs an organization what sits on that one server. TeamCity holds more than that: the cloud-provider keys and container-registry tokens build agents use to deploy, the package-repository credentials that let a pipeline publish under an organization's verified name, and often the code-signing keys that make released software look authentically theirs to every customer who installs it. Server-privilege remote code execution on the orchestrator at the center of that trust chain reaches every one of those credentials at once.

An attacker who gets this far can do more than copy a database: they can insert themselves into a future build until someone notices, the same mechanism behind supply-chain compromises that have previously hit software vendors far larger than the typical EU or UK dev shop. The exposure extends past the TeamCity server itself, to every customer and every downstream system that trusts whatever that server produces.

The Deadline Is Not Yours; the Exploitation Already Is

Binding Operational Directive 26-04 legally binds only US federal civilian agencies, and a development shop in Berlin, Amsterdam or Manchester running TeamCity on-premises owes CISA no compliance report. Reading that as license to patch on the usual schedule mistakes a compliance artifact for a threat forecast.

The fact that matters most is the KEV listing itself. CISA adds a CVE to that catalog only once it has confirmed real attackers are using it against real, internet-facing servers, and an internet-facing TeamCity instance in the EU or UK is exactly as reachable to that attacker as one in Virginia. NIS2 and the UK's own guidance for essential and important entities already expect organizations to treat confirmed active exploitation as an operational emergency, independent of which government's directive happens to name it. The federal deadline passed Saturday; the exposure it was written for is still open.

What to Check This Week

If TeamCity On-Premises is running in your environment, the fix has a version number: upgrade to 2025.11.7 or 2026.1.3. Where an immediate upgrade is not possible, JetBrains' security patch plugin covers versions back to 2017.1 and closes the hole without a full version jump. Until one of those is applied, take the server off the open internet, restrict access to a VPN or another trusted network, and confirm the TeamCity process runs with the minimum OS privileges it needs rather than an administrator account.

Patching closes the door going forward. Whatever already reached the server before the patch was applied deserves separate attention: every credential the TeamCity server could reach, cloud API keys, registry tokens, signing keys, deployment SSH keys, is worth rotating regardless of whether an intrusion has been confirmed, because a deserialization RCE running at server-process privilege does not reliably leave logs proportional to what it accessed. Before the next release ships, recent build artifacts are worth checking against known-good hashes from before the exposure window.

Frequently asked questions

What is CVE-2026-63077?

It is an unauthenticated remote code execution vulnerability in JetBrains TeamCity On-Premises, CVSS 9.8, caused by deserialization of untrusted data in the agent polling protocol. It lets an attacker with no credentials run operating system commands with the privileges of the TeamCity server process. CISA added it to its Known Exploited Vulnerabilities catalog on 5 August 2026, confirming active exploitation.

We are not a US federal agency. Does the 8 August deadline apply to us?

Not legally; Binding Operational Directive 26-04 only binds US federal civilian agencies. More important than the deadline is the KEV listing itself: CISA confirmed this flaw is being actively exploited against real servers, and an internet-facing TeamCity instance in the EU or UK is exactly as reachable as one in the US. Treat the deadline as a useful reference point for when you should already have patched, not as a jurisdiction that exempts you.

We already patched. Is that enough?

Patch first, then assume compromise is possible for any window the server was exposed and unpatched. Rotate cloud provider keys, container registry tokens, code-signing keys and deployment credentials that the TeamCity server could reach, and check recent build artifacts against known-good hashes from before the exposure window. A server-privilege RCE does not reliably leave evidence proportional to what it accessed, so patching alone does not confirm nothing was taken.

CVE-2026-63077 will fade from the KEV catalog's front page the way every flaw eventually does, but the shape of the exposure will not: a CI/CD server holds the keys to everything downstream of it, and patching the version number without checking what nine days of exposure may have already cost addresses only half the problem. That gap, disclosure on 27 July to confirmed exploitation by 5 August, is the number worth remembering longer than the CVE.

TeamCityJetBrainsCVE-2026-63077CISACI/CD security

Patching SharePoint No Longer Closes the Door

CISA added a critical SharePoint Server flaw to its exploited-vulnerabilities list on 17 July 2026 with a 19 July patch deadline. Attackers are stealing server keys, so patching alone leaves the door open. What on-premises owners must do.

4 min read

Cybersecurity

CISA's First AI Agent Platform Is Now a Must-Patch

CISA added Langflow, a popular tool for building AI agents, to its must-patch list after attackers exploited a flaw to steal companies' AI and cloud keys. It is the first AI agent platform the agency has ever flagged, and the fix is upgrade plus key rotation, now.

3 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.