An Unauthenticated Path to Full Server Takeover

A critical flaw in JetBrains TeamCity, one of the most widely deployed continuous-integration and delivery (CI/CD) servers, is now under active exploitation in the wild. Tracked as CVE-2026-63077 and rated a maximum-severity CVSS 9.8, the vulnerability is a deserialization of untrusted data weakness that allows a completely unauthenticated attacker with HTTP(S) access to the server to bypass security checks and execute arbitrary operating-system commands.

The attack abuses TeamCity's agent polling protocol — the channel build agents use to communicate with the server. By sending crafted data through this path, an intruder can run commands with the privileges of the TeamCity server process. There is no requirement for valid credentials, a foothold on the network, or user interaction, which places the flaw among the most dangerous class of pre-authentication remote code execution bugs.

Why a CI/CD Compromise Is a Supply-Chain Nightmare

TeamCity sits at the heart of the software build pipeline, and that is precisely what makes CVE-2026-63077 so consequential. A successful exploit exposes stored credentials, secrets, and connection tokens; lets attackers read and alter server configurations and state; and — most critically — enables tampering with build artifacts. Poisoned artifacts flow downstream to every project and customer that consumes them, turning a single server breach into a potential supply-chain attack echoing the pattern seen in earlier TeamCity-targeting campaigns.

JetBrains published its advisory on July 27, 2026, disclosing that all TeamCity On-Premises builds prior to the fixed releases are affected. Cloud-hosted TeamCity is not in scope. Security researchers, including Rapid7, quickly characterized the bug as unauthenticated RCE, and SecurityWeek subsequently reported that threat actors had begun exploiting it. On August 5, 2026, CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to remediate by August 8, 2026.

Patch and Hunt Immediately

JetBrains has fixed the flaw in TeamCity 2026.1.3 (build 222742) and 2025.11.7 (build 208264). Organizations should upgrade to one of these versions without delay. Teams unable to upgrade right away can apply JetBrains' security patch plugin, compatible with TeamCity 2017.1 and later, though the plugin only addresses this specific issue and is not a substitute for a full upgrade.

Because exploitation is ongoing and TeamCity handles high-value secrets, patching alone is not enough. Assume compromise on any internet-exposed, unpatched server: rotate all stored credentials, API tokens, signing keys, and service-connection secrets; review recent build configurations and artifacts for tampering; and audit server logs for anomalous agent-polling activity. Where feasible, restrict network access to the TeamCity interface to trusted sources only.