Breaking: JetBrains TeamCity RCE Under Active Exploitation — 6 August 2026

JetBrains TeamCity RCE Under Active Exploitation: CISA Adds CVE-2026-63077 to KEV

CISA has added CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in JetBrains TeamCity On-Premises, to the Known Exploited Vulnerabilities catalog with confirmed active exploitation. The vulnerability carries a maximum CVSS 3.1 score of 9.8 and a CVSS 2.0 score of 10.0. Federal agencies have until August 8 to remediate under BOD 26-04.

The flaw is a deserialization of untrusted data vulnerability (CWE-502) in TeamCity's agent polling protocol, the channel distributed build agents use to check in with the central server. An attacker with HTTP or HTTPS network access to a TeamCity server can bypass authentication entirely and execute arbitrary operating system commands with the privileges of the TeamCity server process. No credentials are required. No user interaction is needed. The vulnerability affects every TeamCity On-Premises version ever shipped.

From Disclosure to Active Exploitation in Nine Days

Security researcher Antoni Tremblay privately reported the issue to JetBrains on July 10, 2026. JetBrains publicly disclosed it on July 27, stating there was no evidence of active exploitation at that time. CISA's KEV addition on August 5, with its exploitation assessment upgraded from "none" to "active" and both automatable and total-impact ratings confirmed, means threat actors moved from awareness to weaponisation within nine days of public disclosure. Censys identified roughly 4,500 TeamCity web properties reachable from the internet shortly after disclosure.

This is the second time in 2026 that TeamCity has been in the exploitation spotlight. Storm-1175, the operator behind Medusa ransomware, previously weaponised a different TeamCity vulnerability (CVE-2023-42793) as an initial access vector for ransomware deployment. The product's central role in CI/CD pipelines makes it a high-value target: compromise of a TeamCity server exposes build configurations, stored credentials, and enables supply-chain-style attacks against any software built through the affected instance.

Mitigation

JetBrains has released fixes in TeamCity 2026.1.3 (build 222742) and TeamCity 2025.11.7 (build 208264). An interim security patch plugin covers versions 2017.1 and later. Servers running 2017.1 through 2018.1 must restart after installing the patch; 2018.2 and later can apply it without a restart. Organisations unable to upgrade immediately should restrict network access to TeamCity servers and treat any internet-facing instance as potentially compromised.

So What / Action

If you run TeamCity On-Premises, patch immediately. The 9.8 CVSS score combined with confirmed active exploitation and the 4,500-instance internet exposure makes this a matter of hours, not days. If you cannot patch today, remove TeamCity from internet-facing positions and audit build artefacts and credentials for signs of compromise. This is not a theoretical risk: the same product class was instrumental in Medusa ransomware operations earlier this year, and CISA's rapid escalation from "no evidence of exploitation" to "actively exploited" within nine days indicates determined, capable threat actors are already operational.