The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-63077, a critical unauthenticated remote code execution flaw in JetBrains TeamCity On-Premises, to its Known Exploited Vulnerabilities (KEV) catalog.
The agency’s exploitation assessment moved from “none” to “active,” and it now rates the flaw as both automatable and capable of total technical impact.
CVE-2026-63077 is a deserialization of untrusted data vulnerability (CWE-502) residing in TeamCity’s agent polling protocol the channel distributed build agents use to check in with the central server for job assignments.
JetBrains TeamCity Servers Exploited
An attacker with mere HTTP or HTTPS network access to a TeamCity server can bypass authentication checks entirely and execute arbitrary operating system commands with the privileges of the TeamCity server process, without needing credentials or user interaction.
The flaw carries a maximum CVSS 3.1 score of 9.8 and a CVSS 2.0 base score of 10, and it affects every TeamCity On-Premises version ever shipped.
Security researcher Antoni Tremblay privately reported the issue to JetBrains on July 10, 2026, and the vendor publicly disclosed it on July 27, 2026, at which point JetBrains said it had no evidence of active exploitation.
CISA’s August 5 KEV addition confirms that assumption no longer holds. Successful exploitation can expose TeamCity data, configurations, and stored credentials; modify server state; and compromise the integrity of build artifacts and downstream CI/CD pipelines.
Because TeamCity servers often sit at the center of software build and release workflows, compromise could enable supply-chain-style attacks against any software built through the affected instance.
Internet-facing exposure compounds the risk: Censys identified roughly 4,500 TeamCity web properties reachable from the internet shortly after disclosure.
Mitigation
JetBrains fixed CVE-2026-63077 in TeamCity 2026.1.3 (build 222742) and TeamCity 2025.11.7 (build 208264).
Organizations unable to upgrade immediately can deploy JetBrains’ interim security patch plugin, which covers TeamCity versions 2017.1 and later; servers running versions 2017.1 through 2018.1 must restart after installing the patch, while 2018.2 and later can apply it without a restart.
CISA has given federal agencies until August 8, 2026 to remediate, in line with its BOD 26-04 guidance on prioritizing security updates based on risk.
Agencies unable to apply mitigations must follow the BOD 26-04 guidance for cloud services or discontinue use of the product where patches are unavailable. All stakeholders are urged to evaluate the internet exposure of their TeamCity instances immediately.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
 added CVE-2026-63077, a critical unauthenticated remote code execution flaw in JetBrains TeamCity On-Premises, to its Known Exploited Vulnerabilities (KEV) catalog.){kind=link}