The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical vulnerability in JetBrains TeamCity, identified as CVE-2026-63077. This flaw allows unauthenticated attackers to execute remote code on vulnerable TeamCity On-Premises servers, posing significant risks to software development environments.
TeamCity serves as a continuous integration and continuous delivery (CI/CD) platform, facilitating the building, testing, and deployment of software. A successful exploitation of this vulnerability could grant attackers access to sensitive assets such as source code, build configurations, stored credentials, signing keys, and deployment pipelines. Moreover, attackers might manipulate build outputs or leverage the compromised server to infiltrate broader network infrastructures.
The vulnerability stems from the deserialization of untrusted data within the TeamCity agent polling protocol, which manages communication between build agents and the central server. Exploiting this flaw enables remote attackers with HTTP or HTTPS access to bypass authentication mechanisms and execute operating system commands with the same privileges as the TeamCity server process, all without requiring valid credentials.
JetBrains has acknowledged that all versions of TeamCity On-Premises prior to the security updates are susceptible to this vulnerability. To mitigate the risk, the company has released patched versions 2025.11.7 and 2026.1.3. For organizations unable to upgrade immediately, JetBrains offers a security patch plugin compatible with TeamCity versions 2017.1 and later. However, this plugin addresses only the specific vulnerability, and a comprehensive update remains the recommended long-term solution.
It’s important to note that TeamCity Cloud customers are not affected, as JetBrains has already implemented the necessary protections for these instances.
CISA’s inclusion of this vulnerability in its Known Exploited Vulnerabilities catalog underscores the severity of the threat, confirming that it is being actively exploited in real-world attacks. While the agency has not publicly linked this specific vulnerability to ransomware campaigns, CI/CD systems like TeamCity are high-value targets for threat actors seeking initial access, credential theft, and lateral movement within enterprise environments.
Administrators are urged to take immediate action by identifying all instances of TeamCity On-Premises within their infrastructure, including development, testing, and disaster recovery environments. Promptly updating to the patched versions or applying the security patch plugin is crucial. Additionally, restricting access to TeamCity servers to trusted users, agents, and networks can help minimize exposure.
Security teams should diligently monitor server and web logs for any signs of unusual activity, such as unexpected administrator actions, unfamiliar plugins, new user accounts, or suspicious command executions. In the event of a suspected compromise, it’s essential to preserve relevant logs and system evidence before implementing significant changes. Rotating credentials, tokens, certificates, and other sensitive information accessible through the platform is also advisable, along with reviewing recent builds and release artifacts for unauthorized modifications.
CISA emphasizes the importance of assessing each asset’s internet exposure and adhering to risk-based patching and forensic analysis protocols. Given the potential for unauthenticated remote code execution on a build server to escalate into a full-scale software supply chain incident, swift remediation and continuous monitoring are imperative.
This incident highlights the critical need for organizations to maintain vigilant security practices within their software development pipelines. As CI/CD platforms become increasingly integral to modern development workflows, ensuring their security is paramount to safeguarding the integrity of the software supply chain.
