The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added a critical security flaw in JetBrains TeamCity to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. This vulnerability, identified as CVE-2026-63077 with a CVSS score of 9.8, involves the deserialization of untrusted data, potentially allowing unauthenticated attackers to execute arbitrary operating system commands on affected servers.
JetBrains TeamCity is a widely used continuous integration and continuous deployment (CI/CD) server that facilitates automated building, testing, and deployment of software projects. The identified flaw enables attackers to bypass authentication mechanisms via the TeamCity agent polling protocol, granting them the ability to execute commands with the same privileges as the TeamCity server process. The extent of the impact depends on the server’s privilege configuration but could lead to unauthorized access to sensitive data, alteration of server configurations, and compromise of build artifacts and downstream CI/CD pipelines.
While specific details regarding the exploitation methods, identities of the threat actors, and the scale of the attacks remain undisclosed, the active exploitation status underscores the urgency for remediation. JetBrains has acknowledged the vulnerability and provided patches to address the issue. However, as of now, the company has not updated its advisory to confirm the active exploitation.
In response to this development, CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies apply the necessary patches or mitigations for CVE-2026-63077 by August 8, 2026, in accordance with Binding Operational Directive (BOD) 26-04. This directive emphasizes the importance of promptly addressing high-risk vulnerabilities listed in the KEV catalog to maintain the security and integrity of federal information systems.
Organizations utilizing on-premise versions of JetBrains TeamCity are strongly advised to implement the provided updates without delay. Proactive patch management is crucial in mitigating potential threats and ensuring the resilience of software development and deployment infrastructures.
The recurrence of critical vulnerabilities in widely used CI/CD tools highlights the ongoing challenges in securing software supply chains. As attackers continue to target these platforms, it is imperative for organizations to adopt comprehensive security measures, including regular vulnerability assessments, timely patching, and robust access controls, to safeguard their development environments against emerging threats.
