CISA Warns of Critical JetBrains TeamCity Flaw Being Actively Exploited

A critical remote code execution vulnerability in JetBrains TeamCity is under active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency warned on August 6, 2026, giving federal agencies just days to patch affected systems.

The flaw, tracked as CVE-2026-63077, carries a near-perfect CVSS score of 9.8 and targets on-premise installations of one of the most widely used CI/CD platforms in enterprise software development. With CI/CD pipelines sitting at the heart of modern software supply chains, the stakes for organizations running unpatched TeamCity servers could not be higher.

---

What Makes This Vulnerability So Dangerous

At the core of CVE-2026-63077 is a deserialization of untrusted data weakness. This type of flaw occurs when software processes serialized data from an untrusted source without adequate validation — a class of bug that security researchers have long flagged as particularly hazardous.

"JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol," CISA stated in its advisory.

No Authentication Required — A Critical Aggravating Factor

What makes this flaw especially alarming is that it requires no authentication whatsoever. An attacker with network access to a vulnerable TeamCity server can exploit the agent polling protocol to bypass authentication checks entirely and execute arbitrary operating system commands. The commands run with the same privileges as the TeamCity server process itself — meaning a highly privileged installation hands attackers a powerful foothold.

JetBrains confirmed the scope of potential damage in its own advisory. A successful exploitation can expose TeamCity data, configurations, and stored credentials. Attackers can also modify server state and compromise the integrity of build artifacts and downstream CI/CD pipelines — a scenario reminiscent of the infamous SolarWinds supply chain attack that rattled the security community in 2020.

Why CI/CD Platforms Are High-Value Targets

CI/CD platforms like TeamCity are attractive targets precisely because they touch every stage of the software development lifecycle. Compromising a build server can allow attackers to inject malicious code into software before it ships to end users — turning a single intrusion into a far-reaching supply chain incident. Understanding why robust cybersecurity practices matter for development infrastructure has never been more pressing, particularly as adversaries grow more sophisticated in targeting the tools developers rely on daily.

---

The Federal Deadline and What Organizations Must Do

CISA's move to add CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog triggers mandatory action for a significant portion of the U.S. government. Under Binding Operational Directive (BOD) 26-04, all Federal Civilian Executive Branch agencies are required to prioritize patching vulnerabilities listed in the KEV catalog.

The deadline for federal agencies to apply patches or mitigations for CVE-2026-63077 is August 8, 2026 — just 48 hours after CISA published its warning. That compressed timeline reflects the severity of active exploitation already occurring in the wild.

Immediate Steps for Private Sector Organizations

For private sector organizations, the urgency is equally real. JetBrains has released patches for affected on-premise versions of TeamCity and strongly recommends that administrators apply updates immediately. Organizations that cannot patch right away should:

• Assess whether their TeamCity servers are exposed to untrusted networks
• Consider restricting access to the agent polling protocol as an interim mitigation
• Audit TeamCity server logs for unusual activity via the agent polling protocol
• Review which accounts and credentials may have been accessible to the server process in case a breach has already occurred
• Treat any build artifacts produced by a potentially compromised server as suspect until the environment is confirmed clean

A structured approach to managing and prioritizing vulnerabilities across your organization is essential for responding effectively when high-severity flaws like this emerge — particularly under time pressure.

---

Critical Unknowns and the Broader Threat Landscape

What Remains Unclear

Despite confirmed exploitation, several important details remain unclear. It is not yet known how threat actors are exploiting the vulnerability in practice. The identity of the threat actors conducting the attacks has not been publicly confirmed. The full scale of exploitation activity in the wild is also undetermined at this time.

JetBrains had not updated its advisory to officially confirm active exploitation as of the time of publication. This gap between vendor confirmation and government warning is not unusual — CISA frequently adds vulnerabilities to the KEV catalog based on its own threat intelligence before vendors formally acknowledge in-the-wild abuse.

Nation-State Actors and Historical Targeting of TeamCity

The ambiguity around who is behind these attacks is notable. TeamCity has previously been targeted by nation-state actors. In 2023 and 2024, North Korean and Russian threat actors exploited earlier TeamCity vulnerabilities to gain access to software development environments — underscoring the platform's attractiveness as a target for sophisticated adversaries seeking supply chain footholds.

The Shrinking Window Between Disclosure and Exploitation

The window between public disclosure and widespread exploitation continues to shrink across the cybersecurity landscape. Security teams that once had weeks to respond to critical vulnerabilities now routinely face active attacks within hours or days of a patch being released. Conducting a thorough vulnerability assessment across your attack surface before incidents occur — rather than in response to them — is one of the most effective ways organizations can reduce their exposure to exactly this kind of fast-moving threat.

Final Guidance for TeamCity Administrators

Organizations running JetBrains TeamCity on-premise should treat this vulnerability as a top priority. Applying the available patch immediately is the most effective defense. Beyond patching, security teams should audit server logs for anomalous activity, verify downstream pipeline integrity, and ensure that any potentially exposed credentials are rotated without delay. Any build artifacts produced by a server that may have been compromised should be treated as suspect until a clean environment is fully confirmed.