CISA on August 5, 2026 added the vulnerability CVE-2026-63077 to the Known Exploited Vulnerabilities (KEV) catalog, confirming its active exploitation. The vulnerability affects on-premise versions of JetBrains TeamCity — one of the most widely used continuous integration and delivery platforms. With a CVSS score of 9.8 out of 10, this flaw allows an unauthenticated attacker to execute arbitrary operating system commands on the TeamCity server. U.S. federal agencies are required to remediate the vulnerability by August 8, 2026, but immediate updating is recommended for all organizations using on-premise TeamCity.
Technical nature of the vulnerability
CVE-2026-63077 belongs to the class of insecure deserialization vulnerabilities (CWE-502). According to the CISA description in the KEV catalog, the vulnerability enables unauthenticated remote code execution via the TeamCity agent polling protocol.
The attack vector deserves special attention. The agent polling protocol is an internal mechanism through which TeamCity build agents communicate with the central server. Exploitation of this protocol means that an attacker does not need an account or access to the TeamCity web interface. Network access to the server on the relevant port is sufficient to send specially crafted data that the server will deserialize without proper validation.
Key characteristics of the vulnerability:
- CVE ID: CVE-2026-63077
- Type: insecure deserialization of untrusted data
- CVSS score: 9.8 (critical)
- Authentication: not required
- Vector: TeamCity agent polling protocol
- Exploitation status: active exploitation in real-world attacks confirmed
Scale of potential impact
The consequences of successful exploitation are determined by the privileges under which the TeamCity server process runs. According to JetBrains, an attacker can:
- Gain access to TeamCity data, configurations, and stored credentials
- Modify the state of the server
- Compromise the integrity of build artifacts
- Disrupt downstream CI/CD pipelines
The last point poses the greatest strategic threat. TeamCity, as the central component of CI/CD infrastructure, stores secrets used to access code repositories, container registries, cloud environments, and production servers. Compromising TeamCity is not just the compromise of a single server, but a potential entry point for a software supply chain attack. An attacker who gains control of the build server can inject malicious code into artifacts that are then automatically deployed into production environments.
Credentials stored in TeamCity — access tokens for Git repositories, cloud provider API keys, database passwords — if leaked, enable lateral movement across the organization’s entire infrastructure.
Unknown factors
At the time of publication, it remains unknown exactly how the vulnerability is being exploited in real attacks, which groups are behind this activity, and what its scale is. JetBrains has reportedly not yet updated its security advisory to confirm active exploitation. The lack of public indicators of compromise (IoCs) complicates retrospective hunting for traces of attacks within infrastructure.
It is worth noting that TeamCity has already been a target of serious attacks. Previous critical vulnerabilities in this product have attracted the attention of both financially motivated groups and APT actors, which makes the current situation particularly alarming.
Response recommendations
Given the confirmed active exploitation and the critical CVSS score of 9.8, the response priority is the highest.
- Immediately update on-premise TeamCity to the latest version that fixes CVE-2026-63077. Do not postpone this until a scheduled maintenance window.
- Restrict network access to the ports used by the TeamCity agent polling protocol. Access to these ports should be allowed only from the IP addresses of legitimate build agents.
- Audit stored secrets. If the TeamCity server was accessible from the internet or from untrusted network segments, treat all stored credentials as potentially compromised and rotate them.
- Review TeamCity server logs for anomalous connections over the agent polling protocol, especially from unusual IP addresses.
- Verify the integrity of build artifacts and build configurations for recent weeks — look for unauthorized changes.
- Isolate the TeamCity server from direct internet access, if this has not already been done. Use VPNs or network segmentation.
For U.S. federal agencies, there is a mandatory requirement: in accordance with Binding Operational Directive 26-04, the vulnerability must be remediated by August 8, 2026.
CVE-2026-63077 is a vulnerability that combines three dangerous factors: unauthenticated access, arbitrary code execution, and the strategic position of TeamCity at the center of CI/CD infrastructure. Organizations running on-premise TeamCity must apply the update within the next few hours, restrict network access to the server, and rotate all secrets stored in TeamCity if the server was accessible from untrusted networks.
