CVE -2026-63077 is being actively exploited online, according to the U.S. cybersecurity agency CISA , which added the vulnerability to its Known Exploited Vulnerabilities (KEV) list . The critical flaw affects on-premise versions of JetBrains TeamCity and could allow an unauthenticated attacker to remotely execute arbitrary operating system commands. With a CVSS score of 9.8 , the vulnerability ranks among the most severe reported in the CI/CD tool space this year .
See also: CVE-2026-63030: critical WordPress vulnerability in CISA KEV as actively exploited
The vulnerability was discovered by researcher Antoni Tremblay , who privately reported it to JetBrains on July 10, 2026, via a coordinated disclosure. The company released the security update on July 27, 2026 , releasing patched versions 2025.11.7 and 2026.1.3 , as well as a security patch plugin for versions older than TeamCity 2017.1 and newer. CISA followed suit, updating the KEV entry to indicate active exploitation and setting a remediation deadline for federal agencies of August 8, 2026 .
The technical background of the vulnerability is located in the category CWE-502: Deserialization of Untrusted Data . Specifically, CVE-2026-63077 exploits a flaw in TeamCity 's agent polling protocol , which is used to communicate between the central server and build agents. An attacker with HTTP or HTTPS access to the server can completely bypass authentication checks and execute arbitrary commands with the privileges of the TeamCity server process . No credentials, session tokens, or user interaction are required — just network access to the server is sufficient.
CVE-2026-63077: Why TeamCity is a high-value target
JetBrains TeamCity is one of the most widely used Continuous Integration/Continuous Deployment (CI/CD) in the world, used by thousands of organizations to automate software development. This makes it a particularly attractive target for malicious actors — both ransomware and state-sponsored actors. A successful exploit not only affects the server itself, but can compromise the entire software supplychain.
According to JetBrains, a successful attack via CVE-2026-63077 could expose TeamCity, modify the server state, and compromise the integrity of build artifacts and downstream CI/CD pipelines. This means that an attacker could potentially inject malicious code into applications deployed on the affected infrastructure, extending the attack to end users or customers. The blast radius depends on the privileges granted to the server process, but in many cases these are extensive.
It is worth noting that TeamCity Cloud is not affected by the vulnerability — the issue only affects on-premise installations . However, since many enterprises, especially large corporations and government agencies, maintain on-premise infrastructure for audit and compliance purposes, the scope of the exposure remains significant. All TeamCity On-Premises versions prior to 2025.11.7 and 2026.1.3 are considered vulnerable.
See also: CVE-2026-46817: CISA requests immediate patch for active exploit in Oracle E-Business Suite
CVE-2026-63077: Technical details and risk analysis
The deserialization of untrusted data is particularly dangerous because it allows an attacker to control objects that are deserialized by the application, leading to arbitrary code execution. In the case of CVE-2026-63077, the flaw is in the agent polling protocol — a communication channel normally used by build agents to "query" the server for new tasks. The fact that this channel is accessible without authentication is the critical point of weakness.
Security researchers characterize the vulnerability as automatable with total technical impact, meaning that a single successful exploit could grant complete control over the vulnerable server process. This, combined with the fact that no user interaction is required, makes CVE-2026-63077 ideal for large-scale automated attacks. CISA has already confirmed that there is evidence of actual exploitation, although no details have been disclosed about the threat actors or the number of victims.
TeamCity ’s history as a target for cyberattacks is troubling. Similar unauthenticated RCE and authentication bypass vulnerabilities have been exploited rapidly in the past, often by state-sponsored groups targeting the software supply chain. TeamCity ’s position at the center of the software development process makes it a goldmine for attackers looking to infiltrate multiple organizations through a single point of entry.
CVE-2026-63077: Protection guidelines and immediate actions
JetBrains and CISA recommend an immediate upgrade to TeamCity 2025.11.7 or 2026.1.3 , depending on the release branch being used. For organizations that cannot upgrade immediately, JetBrains has a security patch plugin for TeamCity 2017.1 and later that addresses the vulnerability without a full upgrade. In either case, applying the update should be treated as an urgent priority.
In addition to the update, organizations should take additional security measures. Specifically, it is recommended to restrict network access to the TeamCity server , especially from untrusted networks, until the update is applied. It is also critical to review logs for suspicious activity, such as unexpected server-side command execution , unusual changes to builds, or suspicious access to credentials. Given that the vulnerability may have exposed stored secrets and build artifacts , organizations should consider rotating all credentials stored on the system and verifying the integrity of the artifacts produced.
According to Binding Operational Directive (BOD) 26-04 , Federal Civilian Executive Branch (FCEB) agencies are required to prioritize the remediation of high-risk vulnerabilities listed in the KEV list . The deadline for CVE-2026-63077 is set at August 8, 2026. While this obligation applies to U.S. government agencies, it is a clear message to all organizations worldwide — including Greek businesses and public agencies — that the vulnerability must be addressed without delay.
See also: CVE-2026-0770: CISA puts Langflow RCE in KEV and requests immediate patch by 24/7
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
In summary, CVE-2026-63077 represents one of the most serious threats to software development infrastructures this year. Its criticality lies not only in its CVSS score of 9.8 and the ability to execute code without authentication, but also in TeamCity in the software supply chain. Organizations using JetBrains TeamCity On-Premises should act immediately. CISA has already confirmed active exploitation, making any delay in remediation extremely dangerous.
