CVE-2026-63077: TeamCity Is Under Active Attack Right Now

On July 27, JetBrains disclosed a critical vulnerability in its TeamCity On-Premises software and stated that it was not aware of any active exploitation. On August 5, the US Cybersecurity and Infrastructure Security Agency added the same vulnerability to its Known Exploited Vulnerabilities catalog and gave federal agencies three days to patch. The vendor’s reassurance lasted ten days.

The gap between those two statements is worth examining carefully, because it is not anomalous. It is the new standard timeline for software vulnerabilities affecting build infrastructure, and the organizations that treated JetBrains’ July 27 disclosure as a routine patching matter are now managing a different kind of situation entirely.

What the vulnerability does

CVE-2026-63077, assigned a CVSS score of 9.8, is a deserialization of untrusted data flaw in TeamCity’s agent polling protocol, the channel that distributed build agents use to communicate with the central server. An attacker with nothing more than HTTP or HTTPS network access to a TeamCity server can bypass authentication entirely and execute arbitrary operating system commands with the privileges of the server process. No credentials are required. No user interaction is needed. Roughly 4,500 TeamCity web properties were reachable from the internet at the time of disclosure, according to Censys.

JetBrains released patched versions 2025.11.7 and 2026.1.3 alongside the advisory. It also made available a security patch plugin for organizations running versions back to 2017.1 that cannot immediately upgrade. TeamCity Cloud customers required no action, as the vendor had already applied fixes to hosted infrastructure.

Why a compromised build server is not like other compromises

TeamCity sits at the center of software build and deployment pipelines. A server running TeamCity typically holds source code access tokens, cloud provider credentials, code signing materials, deployment secrets, and build configurations connecting to production environments. Attackers who gain command execution on a TeamCity server do not simply gain access to one machine. They gain access to everything that machine is configured to reach, and the ability to modify what it produces.

That second capability is the one that makes build infrastructure a distinctive target. An attacker with persistent access to a TeamCity server can alter build artifacts before they ship to production. Software that passes internal review and automated testing can leave the pipeline containing code that was not written by the development team. The end users of that software, and in enterprise contexts the customers of the organization running it, have no visibility into what happened upstream.

This is the supply chain attack vector that the security industry has spent years warning about in abstract terms. CVE-2026-63077 makes it a concrete and immediate operational risk for every organization running an unpatched on-premises TeamCity instance.

The pattern that preceded this week

CVE-2026-63077 is the third critical unauthenticated vulnerability in TeamCity in two years. CVE-2023-42793 was exploited in 2023 by APT29, Russia’s foreign intelligence service, to compromise build pipelines across multiple sectors. CVE-2024-27198 and CVE-2024-27199 were exploited in early 2024 by multiple threat actors within days of disclosure. Each time, the window between public disclosure and confirmed exploitation has narrowed.

Die August 5 CISA addition came nine days after JetBrains published its advisory. The August 8 federal remediation deadline gave agencies three days from CISA’s confirmation. Organizations outside the federal government operate without that formal mandate, but the implicit message is the same: the standard thirty-day enterprise patch cycle is not compatible with the exploitation timeline for critical CI/CD vulnerabilities.

What you should do now

JetBrains’ guidance is straightforward. Organizations running TeamCity On-Premises should upgrade to version 2025.11.7 or 2026.1.3. Those unable to upgrade immediately should install the security patch plugin, which is available for TeamCity 2017.1 and later. The plugin addresses only CVE-2026-63077 and does not substitute for a full upgrade.

CISA’s advisory adds a forensic dimension that JetBrains’ guidance does not address. Organizations should assume that internet-facing TeamCity servers that were unpatched between July 27 and today may have been accessed. The absence of visible indicators of compromise on the server itself is not sufficient reassurance, given that attackers with command execution can clean logs and establish persistence through mechanisms that standard host-based monitoring does not detect.

The build pipeline is where software becomes what it is. It warrants the same scrutiny as production infrastructure, and in most organizations, it does not receive it.

CybelAngel monitors exposed build infrastructure, leaked credentials, and compromised CI/CD assets across the external attack surfaces of its clients.