This JetBrains TeamCity Flaw Is Being Exploited Right Now

Michael Miller · 2026-08-06

If you're running an on-premise version of JetBrains TeamCity, you need to stop what you're doing and pay attention. A newly patched security flaw is now under active exploitation in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). That's not a drill, and it's not a hypothetical threat someone cooked up to scare you. It's happening right now. The vulnerability in question is CVE-2026-63077, and it carries a CVSS score of 9.8 out of 10. That's about as severe as it gets. For context, anything above 9.0 is considered critical, reserved for flaws that are both easy to exploit and potentially devastating in impact. This one checks both boxes. ### What Exactly Is CVE-2026-63077? At its core, this is a deserialization of untrusted data issue. That sounds technical, but here's the plain-English breakdown: TeamCity takes data that comes in from an outside source and processes it without properly verifying what it actually is. An attacker who can reach your TeamCity server can craft malicious data, send it over, and the server will unwittingly process it. What does that mean for you? It means an unauthenticated attacker—someone with no credentials, no special access, nothing—could potentially execute arbitrary code on your server. They don't need a username or password. They just need network access to the machine running TeamCity. ### Why This Should Worry You TeamCity is a CI/CD server. That means it sits at the heart of your software development pipeline. It builds your code, runs your tests, and often holds credentials for deploying to production environments. If an attacker gains control of that server, they're not just breaking into one box. They're getting a foothold into your entire development and deployment infrastructure. - They could steal source code - They could inject malicious code into your builds - They could steal API keys and deployment credentials - They could pivot to other systems on your network That's a nightmare scenario for any development team, and it's why CISA has added this CVE to its Known Exploited Vulnerabilities catalog. When CISA does that, it's a strong signal that the threat is real and actively being used. ### What You Should Do Right Now If you haven't patched your TeamCity server yet, that's your first move. JetBrains has already released a fix, so make sure you're running the latest version. Check your version against the patched release, and if you're behind, prioritize that update like your infrastructure depends on it—because it does. Here's a quick checklist to work through: - Apply the latest TeamCity security patch immediately - Check your server logs for any suspicious activity - Review your firewall rules to limit access to TeamCity - Enable multi-factor authentication for all admin accounts - Monitor for any unauthorized changes to your build configurations ### The Bigger Picture This is a reminder that on-premise software carries real responsibility. When you host your own tools, you're the one responsible for keeping them secure. Cloud-hosted versions get patched automatically, but self-hosted setups require vigilance. If you're running TeamCity on-premise, you can't afford to delay security updates. The exploitation of this flaw is a wake-up call. Attackers are actively scanning for vulnerable servers, and they're not waiting around for you to get around to patching. They're moving fast, and you need to move faster. If you're not sure whether your server is vulnerable, check your version right now. If you're running an unpatched version, assume you're at risk and act accordingly. The window between a patch being released and attackers weaponizing it keeps shrinking, and this case is a perfect example of that trend. Stay safe out there. Your pipeline depends on it.