Critical RCE in JetBrains TeamCity (CVE-2026-63077): Active Exploitation Alert

A critical security vulnerability has emerged in JetBrains TeamCity, one of the most widely used CI/CD (Continuous Integration and Continuous Deployment) platforms. The flaw, tracked as CVE-2026-63077, carries a nearly-maximum CVSS score of 9.8. This rating reflects its severe impact: an unauthenticated attacker can achieve full remote code execution (RCE) on the TeamCity server. Given TeamCity’s central role in the software development lifecycle, this vulnerability presents an immediate and existential threat to the security of affected supply chains.

On August 5, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog. This move confirms that the flaw is not just a theoretical risk but is being actively exploited by malicious actors in the wild. Consequently, organizations must prioritize its remediation to prevent server compromise and downstream supply chain attacks.

Understanding the Vulnerability

The technical root of CVE-2026-63077 is a deserialization of untrusted data (CWE-502) flaw residing within the TeamCity agent polling protocol. In essence, the TeamCity server improperly handles specifically crafted data packets sent to its agent-facing endpoints. An attacker with network access to the TeamCity server can send a malicious payload that triggers the execution of arbitrary operating system commands.

Crucially, this attack does not require any user interaction or valid login credentials. Because the agent polling protocol is designed to facilitate communication between build agents and the central server, the vulnerable endpoint is often exposed to ensure agents can report their status and receive build instructions. This exposure provides a direct path for unauthenticated attackers to pivot into the heart of an organization’s build environment.

Systems and Software Affected

The vulnerability affects all versions of JetBrains TeamCity On-Premises releases prior to the designated fix versions. While TeamCity Cloud customers have already been patched by JetBrains, all self-hosted installations are vulnerable unless they have been explicitly updated or patched with the official security plugin.

Vulnerable systems include those running versions as far back as 2017.1, making this a legacy-reaching threat for organizations that may not have updated their build infrastructure in several years.

The Scope of Impact

In a modern “DevSecOps” environment, the CI/CD server is the “crown jewels” of the organization. Compromising a TeamCity server grants an attacker administrative access to the entire build pipeline, which carries catastrophic consequences:

• Source Code and Credential Theft: Attackers can access private repositories, API keys, signing certificates, and cloud infrastructure credentials stored within the build configurations.
• Supply Chain Injection: Malicious actors can inject backdoors or malware into software builds during the compilation process. This allows them to distribute poisoned software to thousands of customers without ever touching the original source code repository.
• Lateral Movement: Once the server process is compromised, attackers can use the server’s identity to move laterally through the internal network or the connected cloud environment.

Mitigation and Remediation Steps

Due to the active exploitation of this flaw, immediate action is required. Organizations should follow these remediation paths:

1. Immediate Upgrade (Recommended)

The most comprehensive way to secure your environment is to upgrade your TeamCity On-Premises server to one of the following versions:

• TeamCity 2025.11.7
• TeamCity 2026.1.3

These versions contain the full fix for CVE-2026-63077 along with other general security and stability improvements.

2. Security Patch Plugin

For organizations unable to perform a full version upgrade immediately, JetBrains has released a standalone security patch plugin compatible with TeamCity 2017.1 and newer.

• For versions 2017.1 through 2018.1: The plugin requires a manual installation and a mandatory server restart.
• For versions 2018.2 and later: The plugin can be enabled without a server restart.

Note: The plugin only addresses CVE-2026-63077. It is a temporary mitigation and does not substitute for a full version upgrade.

3. Tactical Security Hardening

Beyond patching, security teams should implement broader defensive measures:

• Network Segmentation: Restrict access to the TeamCity server to a trusted VPN or an internal management network. Never expose the web interface or agent polling ports directly to the public internet.
• Least Privilege: Ensure the TeamCity server process runs with the minimum possible operating system permissions. If an attacker achieves RCE, they will be limited by the permissions of that service account.
• Audit and Monitor: Review TeamCity access logs for suspicious requests to the agent polling endpoints and monitor the server for unusual process executions (e.g., cmd.exe or /bin/bash originating from the TeamCity service).

The time to act is now. With CISA’s August 8, 2026 deadline for federal agencies approaching, the window for remediation is closing before the threat becomes widespread.