CISA flags actively exploited JetBrains TeamCity flaw after critical RCE patch

CISA has added CVE-2026-63077, a critical JetBrains TeamCity On-Premises vulnerability, to its Known Exploited Vulnerabilities catalog after finding evidence that attackers are exploiting it in the wild. The move turns an already urgent vendor patch into a time-bound operational priority for teams that run self-hosted TeamCity servers.

JetBrains disclosed the flaw in late July and said it affects all TeamCity On-Premises versions before the fixed 2025.11.7 and 2026.1.3 releases. The company describes the bug as an unauthenticated remote code execution issue: an attacker with HTTP or HTTPS access to a TeamCity server could bypass authentication checks and run operating-system commands with the privileges of the TeamCity server process.

Why it matters

TeamCity is used to build, test, and deploy software, so a compromise can reach beyond one server. CI/CD systems commonly hold source-code access, build secrets, package-signing materials, deployment credentials, and connections to production environments. That makes exposed build infrastructure attractive to attackers looking for a path into software supply chains.

CISA's catalog entry identifies the weakness as deserialization of untrusted data and gives federal civilian agencies a remediation deadline of August 8, 2026 under its current risk-based patching directive. While the binding deadline applies to U.S. federal civilian executive branch agencies, private organizations often use the KEV catalog as a practical list of vulnerabilities that deserve immediate triage because exploitation is no longer theoretical.

Admins should first determine whether they operate TeamCity On-Premises and whether the service is reachable from untrusted networks. JetBrains says TeamCity Cloud customers do not need to take action for this issue. For self-hosted environments, the preferred mitigation is to upgrade to 2025.11.7 or 2026.1.3. JetBrains also provides a security patch plugin for organizations that cannot immediately upgrade, though the vendor says upgrading remains the broader security fix.

• Check internet-facing and internal TeamCity servers for affected versions.
• Upgrade to the fixed releases where possible, or apply JetBrains' patch plugin as an interim control.
• Review build agents, credentials, recent build steps, and deployment tokens for signs of misuse if exposure existed.

The practical takeaway is simple: teams should treat TeamCity as production-grade infrastructure, not just a developer utility. Once an RCE in a build server reaches CISA's exploited list, delaying the fix increases both incident-response risk and software-supply-chain exposure.

Sources

• www.cisa.gov
• blog.jetbrains.com
• nvd.nist.gov

Cover photo by Pixabay on Pexels, used under the Pexels License.