JetBrains TeamCity Vulnerability CVE-2026-63077 Under Active Exploitation

Active in-the-wild exploitation is targeting a critical JetBrains TeamCity vulnerability tracked as CVE-2026-63077. Carrying a maximum CVSS severity score of 9.8, the security defect allows unauthenticated remote attackers to execute arbitrary operating system commands on vulnerable CI/CD servers. Because TeamCity acts as a central nervous system for build automation, enterprise deployment pipelines, and source code management, compromise of the application server grants attackers an immediate foothold into core corporate infrastructure.

The flaw affects all JetBrains TeamCity On-Premises deployments. Organizations running unpatched instances face immediate risk of full server takeover, credential harvesting, and software supply chain contamination.

How the CVE-2026-63077 Vulnerability Works

At its core, CVE-2026-63077 is an unsafe deserialization defect triggered when handling untrusted incoming data. In modern software architecture, serialization converts complex object structures into streamable formats—such as byte streams transmitted over network protocols—while deserialization reconstructs those objects back into active application memory. When an application deserializes untrusted input without strictly validating the incoming object types or applying structural security controls, attackers can craft malicious serialized payloads containing execution gadgets. These gadgets leverage pre-existing classes within the application classpath to trigger unintended logic execution during object reconstruction.

In the case of TeamCity, an unauthenticated attacker can deliver these payloads via HTTP or HTTPS requests directly to application endpoints, specifically targeting the TeamCity agent polling protocol. This protocol manages ongoing communication between the central TeamCity server and distributed build agents. By manipulating network traffic passed through this communication channel, an attacker can bypass authentication checks entirely.

Once the deserialization routine processes the malicious payload, the underlying host executes arbitrary operating system commands with the exact system privileges assigned to the TeamCity server process. If the TeamCity service runs under elevated privileges—such as root on Linux systems or SYSTEM on Windows hosts—the attacker gains unconstrained control over the underlying operating system without needing valid application credentials or pre-existing network access.

Blast Radius: Why CI/CD Platforms Are High-Value Targets

Continuous integration and continuous delivery (CI/CD) infrastructure represents one of the highest-value targets within modern enterprise environments. Platforms like JetBrains TeamCity orchestrate software compilation, run automated testing, and store critical secrets required to deploy code across internal and production environments.

A successful remote code execution attack on a TeamCity server typically exposes:

• Source Code and Intellectual Property: Direct access to uncompiled source repositories, internal tool chains, and proprietary software designs.
• Embedded Secrets and Production Credentials: Build configurations and job parameters frequently store high-value secrets, including API tokens, database passwords, private SSH keys, code-signing certificates, and cloud infrastructure access keys for AWS, Azure, or GCP.
• Software Supply Chain Exposure: Gaining execution rights on a build platform allows attackers to tamper with build scripts, alter binary outputs, or inject malicious code into software artifacts before distribution to downstream clients or internal cloud deployments.
• Lateral Movement Capabilities: Because build servers require extensive network connectivity to access source control managers, artifact registries, and internal deployment targets, a compromised TeamCity instance serves as an exceptional jump box for pivot attacks across internal networks.

Given these operational dependencies, an unauthenticated remote code execution bug in a central deployment controller converts a single vulnerable web service into a complete breakdown of enterprise software trust boundaries.

Exploitation Status and Regulatory Directives

Although JetBrains originally disclosed and patched the defect following a private report—noting at the time that no active exploitation had been observed—threat actors quickly operationalized the issue following public disclosure. CISA confirmed in-the-wild exploitation by adding CVE-2026-63077 to its Known Exploited Vulnerabilities catalog.

Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies are mandated to apply the vendor-provided patches within three days to protect federal networks from compromise. While public details regarding specific threat actor groups or post-exploitation payloads remain undisclosed, historical patterns targeting CI/CD platforms indicate that adversaries rapidly deploy automated mass-scanning tools to identify internet-facing management portals, drop persistent webshells, and harvest host memory for administrative credentials.

Required Remediation and Patching Actions

Organizations running JetBrains TeamCity On-Premises must prioritize immediate emergency patching across all environments. Vendor updates are available, and administrators should execute the following steps:

1. Apply Server Upgrades: Upgrade all TeamCity On-Premises installations immediately to patched versions 2025.11.7 or 2026.1.3.
2. Deploy Legacy Patch Plugin: For organizations unable to perform a full system upgrade immediately due to operational constraints, JetBrains has provided a dedicated security patch plugin supporting legacy installations running TeamCity version 2017.1 or newer.
3. Restrict Network Access: Ensure TeamCity web portals and agent polling interfaces are removed from public internet access and placed behind strict network controls, such as enterprise VPNs, Zero Trust Network Access (ZTNA) solutions, or precise IP access control lists.
4. Audit Process Privileges: Verify that the TeamCity server process runs under a dedicated, minimal-privilege service account rather than high-privilege system accounts to reduce the impact of system command execution.
5. Conduct Threat Hunting: Inspect server host logs, agent communication logs, and web server access logs for anomalous HTTP/S requests directed at agent polling endpoints, unexpected child processes spawned by the TeamCity parent process, or unauthorized outbound connection attempts from the server host.