The Cybersecurity and Infrastructure Security Agency added a critical JetBrains TeamCity vulnerability to its Known Exploited Vulnerabilities catalog on August 5, 2026. The listing confirms that attackers are actively breaking into build servers many enterprises assumed sat safely behind a firewall. The flaw, tracked as CVE-2026-63077, carries a CVSS score of 9.8 out of a possible 10. It lets an unauthenticated attacker with network access to a TeamCity server execute arbitrary operating system commands on it, no password required.
CISA gave federal civilian agencies until CISA’s federal deadline for the June 2026 ColdFusion vulnerability was **July 10, 2026**, not August 8, 2026.[9] Three days. That is one of the shortest remediation windows the agency has issued all year, and it signals how fast exploitation moved once the bug became public knowledge.
The urgency traces back to a familiar name. TeamCity, the JetBrains-built CI/CD server, suffered a nearly identical crisis in 2024, when hackers used a different authentication-bypass bug to break into thousands of internet-facing servers within weeks of disclosure. JetBrains says this new flaw was caught through coordinated disclosure before the public advisory went out, but that head start did not last long. Here is what the vulnerability does, how it stacks up against the 2024 incident, and what it means for the CI/CD tooling market TeamCity competes in.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is CVE-2026-63077? Inside the JetBrains TeamCity Flaw
CVE-2026-63077 is an unauthenticated remote code execution vulnerability in TeamCity On-Premises, the self-hosted edition of JetBrains’ continuous integration and delivery server. JetBrains disclosed the bug in a security advisory published July 27, 2026, alongside fixed releases 2025.11.7 and 2026.1.3 that JetBrains says each closed more than 20 security vulnerabilities in total, not just this single critical flaw. “A critical security vulnerability has been identified in TeamCity On-Premises and assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2026-63077,” the company wrote in its advisory.
Every supported on-premises release is affected until the server is upgraded past the patched versions. TeamCity Cloud, the hosted edition JetBrains operates itself, is not exposed to this bug. JetBrains says cloud customers do not need to take any action, because the relevant protections were already applied before the advisory went public.
The practical danger sits in what an attacker gains once the bug is exploited. JetBrains warned that “if exploited, this vulnerability may allow an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands,” according to the official advisory. TeamCity servers typically hold source code access tokens, deployment credentials, and secrets used to push builds into production. One compromised instance can become a foothold across an entire software supply chain.
How the Exploit Works: Deserialization via the Agent Polling Protocol
The National Vulnerability Database classifies the bug as an unsafe deserialization issue, tracked under CWE-502. Its entry states plainly that “in JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol,” per the NVD record. The agent polling protocol is how TeamCity build agents check in with the central server to pick up new jobs, a mechanism running on essentially every production deployment.
Security researchers at Rapid7 traced the root cause to a permissive XStream allowlist inside the server’s deserialization handling. XStream converts serialized data back into Java objects. When the allowlist governing which object types are permitted is too loose, an attacker can smuggle in a malicious payload disguised as legitimate agent traffic. The fix tightens that allowlist by introducing a NoTypePermission.NONE default before applying TeamCity’s own permitted list, closing the gap attackers were using to reach arbitrary code execution.
No authentication is required to reach the vulnerable code path. The resulting commands run with the privileges of the TeamCity server process itself, which on most installations has broad read and write access to build configurations, artifacts, and stored credentials.
Timeline: From Private Disclosure to CISA’s Exploited List
The path from discovery to confirmed active exploitation took less than a month. A researcher flagged the bug privately, JetBrains shipped a fix, and within nine days of the public advisory, the federal government confirmed attackers were already using it.
- July 10, 2026: The bug is privately reported to JetBrains. “This unauthenticated remote code execution vulnerability was reported to us privately on July 10, 2026, by Antoni Tremblay in accordance with our coordinated disclosure policy,” JetBrains wrote.
- July 27, 2026: JetBrains publishes its advisory and ships fixed versions 2025.11.7 and 2026.1.3, along with a patch plugin for TeamCity 2017.1 and later. At this point, JetBrains says it had no evidence of active exploitation.
- August 5, 2026: CISA adds CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, a designation reserved for flaws with confirmed real-world exploitation.
- August 6, 2026: Independent outlets including Security Affairs report on the KEV listing, with founder and longtime security journalist Pierluigi Paganini covering the federal catalog addition within a day of it going live.
- August 8, 2026: CISA’s remediation deadline for federal civilian executive branch agencies, giving affected agencies roughly three days from the KEV listing to patch or isolate exposed TeamCity servers.
That compressed window between disclosure and confirmed exploitation is the story here. TeamCity vulnerability CVE-2026-63077 went from a coordinated, quiet fix to a federally mandated emergency patch inside two weeks. That pace leaves little room for enterprises running slow change-management processes.
CVE-2026-63077 at a Glance
The table below summarizes the core technical and timeline details security teams need to assess exposure.
| Detail | Data |
|---|---|
| CVE identifier | CVE-2026-63077 |
| CVSS 3.1 score | 9.8 (Critical) |
| Vulnerability class | Unauthenticated RCE via unsafe deserialization (CWE-502) |
| Attack vector | Network, no authentication required |
| Affected product | JetBrains TeamCity On-Premises, all versions prior to the fix |
| Not affected | TeamCity Cloud |
| Privately reported | July 10, 2026, by researcher Antoni Tremblay |
| Publicly disclosed | July 27, 2026 |
| Fixed versions | 2025.11.7 and 2026.1.3 |
| Patch plugin availability | TeamCity 2017.1 and later |
| Added to CISA KEV catalog | August 5, 2026 |
| Federal remediation deadline | August 8, 2026 |
Who’s at Risk: TeamCity’s Role in the CI/CD Pipeline
TeamCity is a commercial continuous integration and continuous delivery server used to build, test, and deploy software, competing directly with Jenkins, GitHub Actions, GitLab CI, and CircleCI. Organizations run it to automate the steps between a developer committing code and that code reaching production. That puts the server at a uniquely sensitive point in the software lifecycle.
Successful exploitation of this flaw can expose TeamCity data, configuration files, and stored credentials, or let an attacker tamper directly with build artifacts and the CI/CD pipeline itself. That last point is what separates a CI/CD server compromise from an ordinary web application breach. An attacker who modifies a build artifact does not just steal data. They can potentially inject malicious code into every downstream product that server builds, turning a single intrusion into a supply chain attack against every customer of the affected organization.
Enterprise vs. Cloud: Why TeamCity Cloud Customers Are Safe
The split between TeamCity On-Premises and TeamCity Cloud matters more than usual here. On-premises deployments put patch timing entirely in the customer’s hands, which is exactly why CISA’s three-day federal deadline is so aggressive: it assumes IT teams can act immediately once notified. TeamCity Cloud customers, by contrast, had the fix applied on their behalf before JetBrains ever published the advisory, since the vendor controls that infrastructure directly. It is the clearest real-world argument yet for teams debating whether to keep managing CI/CD infrastructure themselves.
Déjà Vu: How This Compares to the 2024 TeamCity Crisis
This is not the first time a critical TeamCity bug has forced emergency patching across the industry. In March 2024, JetBrains disclosed two authentication-bypass flaws, CVE-2024-27198 (CVSS 9.8) and CVE-2024-27199 (CVSS 7.3), both fixed in version 2023.11.4. The fallout was severe. Censys scanned the internet and found 5,699 affected hosts globally still exposed after disclosure. Cloud security firm Wiz separately reported that roughly Wiz reported that **10% of cloud environments** it monitored had a TeamCity instance running, not “10% of monitored environments” in general.[7] Of those, The vulnerable-share figure in the cited reporting was **8.5% of monitored cloud environments** early in March 2024, but that statistic is not about the 2026 Adobe ColdFusion issue; for the ColdFusion issue the relevant 2026 data are different.[7]
What followed was not theoretical. Trend Micro documented attackers using the 2024 TeamCity flaws to deploy Jasmin ransomware and other malware against exposed servers. Cloud security company Orca went further, estimating that as many as 84% of publicly accessible vulnerable instances may have been compromised in the exploitation wave that followed disclosure. Coverage of the current bug has explicitly invoked that history, noting that TeamCity flaws “have been extensively leveraged in the past, including by ransomware gangs and state-backed actors.”
Two critical CVEs in a build-server product two years apart is one pattern. But 2026 alone tells a tighter story: JetBrains patched CVE-2026-44413 in TeamCity 2026.1 back in May 2026, affecting on-premises versions 2025.11.4 and earlier; SentinelOne flagged an unauthenticated SSRF flaw in the build status feature, CVE-2026-49372, fixed in versions 2026.1 and 2025.11.5 that June; a reflected XSS bug in the keyword filter, CVE-2026-49371, was closed in 2026.1.1 that July; and NVD logged CVE-2026-65906 as affecting versions before 2026.1.2 and 2025.11.6 that same month. Five notable CVEs patched in a single product across five months is a pattern, not a coincidence. It’s why security teams that lived through March 2024 moved so fast this time.
| Metric | March 2024 (CVE-2024-27198 / 27199) | July–August 2026 (CVE-2026-63077) |
|---|---|---|
| CVSS score | 9.8 and 7.3 | 9.8 |
| Vulnerability class | Authentication bypass | Unsafe deserialization / auth bypass via agent polling protocol |
| Disclosure date | March 4, 2024 | July 27, 2026 |
| Fixed in | Version 2023.11.4 | Versions 2025.11.7 and 2026.1.3 |
| Internet-exposed hosts identified | 5,699 (Censys scan) | No independent 2026 scan total published yet |
| Cloud environments running TeamCity | ~10% of monitored environments (Wiz) | Not applicable, TeamCity Cloud unaffected by this flaw |
| Confirmed exploitation outcome | Jasmin ransomware deployment (Trend Micro); up to 84% of exposed vulnerable instances possibly compromised (Orca estimate) | Added to CISA KEV catalog August 5, 2026, confirming active in-the-wild exploitation |
The CI/CD Attack Surface: Why Build Servers Are a Hacker’s Favorite Target
Build servers occupy an odd blind spot in enterprise security. Companies pour budget into protecting production databases and customer-facing applications. Meanwhile, the CI/CD server that assembles and ships the code behind those applications often runs with far broader trust than any single production system. It holds the API keys, cloud credentials, and signing certificates needed to push new code live. It typically has network access to source repositories, artifact registries, and deployment targets, all at once.
That combination makes a CI/CD server one of the highest-leverage single points of compromise available to an attacker. Breaching a single web server nets access to that server. Breaching a build server can net access to everything that server touches, plus the ability to quietly insert malicious code into software before it ever reaches a customer. That is the exact playbook behind major supply chain incidents in recent years. This flaw fits that pattern precisely, since it does not just leak data, it hands an attacker command execution on the machine trusted to build and ship an organization’s software.
Unauthenticated access is what makes this particular flaw so dangerous relative to typical vulnerabilities. There is no credential-stuffing step, no phishing email required, no insider needed. Any TeamCity On-Premises server reachable over HTTP or HTTPS before patching was a target, regardless of how strong its passwords or multi-factor authentication policy happened to be.
Market Impact: A Critical Flaw Hits a Growing CI/CD Industry
JetBrains is privately held, so there is no stock price to move the way a public company’s shares might dip after a breach disclosure. But the reputational stakes are real in a market that keeps expanding. Market Research Future sized the global CI/CD tools market at $9.42 billion in 2025, projecting a 15.19% compound annual growth rate through 2035. Other estimates run higher: Research and Markets put the figure at $11.85 billion for 2026 with a 14.12% CAGR, while Persistence Market Research pegged it at $13.2 billion for the same year. The spread between estimates reflects differing methodologies. All three point in the same direction: a market measured in the billions, growing at double-digit rates as more engineering teams automate their build and release pipelines.
That growth is exactly what makes a TeamCity vulnerability like this one consequential beyond the immediate patch cycle. Enterprise buyers evaluating CI/CD platforms increasingly weigh security track record alongside features and pricing. A second critical, actively exploited CVE in roughly two years gives competitors an opening to make security posture part of the sales pitch. JetBrains’ response, a coordinated disclosure process, same-day fixed releases, and a patch plugin reaching back to version 2017.1, is the kind of track record security buyers will scrutinize when renewal conversations come up.
Competitive Landscape: TeamCity vs. Jenkins, GitHub Actions, and GitLab CI
TeamCity, built by JetBrains (also the maker of IntelliJ IDEA and PyCharm), competes in a crowded CI/CD field that includes the open-source Jenkins project, GitHub Actions, GitLab CI, and CircleCI. The competitive lines largely run along deployment model. Jenkins and TeamCity On-Premises are typically self-hosted, putting patch timing squarely in the customer’s hands. GitHub Actions and GitLab’s SaaS tier shift more of that operational burden onto the platform vendor, similar to how TeamCity Cloud operates relative to its own on-premises sibling.
That structural difference is central to how this incident played out. TeamCity Cloud customers needed to do nothing, while On-Premises customers had a hard federal deadline within days. It is a live demonstration of the tradeoff self-hosted CI/CD software has always carried. More control over infrastructure, yes, but the full weight of the patch clock lands on the customer’s own security team, not the vendor’s. Expect that tradeoff to feature prominently in competitive sales conversations as rivals point to their own managed-patching track records.
Expert and Industry Reaction
JetBrains has been direct about both the severity of the bug and its own disclosure process. The company credited the researcher who found it and laid out a clear remediation path rather than downplaying the risk. That response stands in contrast to vendors who have historically minimized early vulnerability reports.
Independent security researchers reached similar conclusions about severity from their own analysis. Rapid7 confirmed the disclosure timeline and technical root cause in its own writeup. The firm noted that “on July 27, 2026, JetBrains published a security advisory for CVE-2026-63077, a critical unsafe deserialization vulnerability affecting JetBrains TeamCity,” in its published research. That kind of independent, same-day confirmation from a threat intelligence vendor mattered. It’s part of why the security community treated the bug as an emergency from day one, rather than waiting for proof of active exploitation.
Coverage from outlets including The Hacker News and SecurityWeek tracked the shift from disclosure to confirmed exploitation in near real time. That level of scrutiny reflects how closely the security press now monitors CI/CD vulnerabilities after the 2024 precedent.
What Security Teams Should Do Right Now
Patch Immediately
The first step is upgrading to TeamCity 2025.11.7 or 2026.1.3, the two fixed releases JetBrains shipped alongside the July 27 advisory; JetBrains says each release closed more than 20 security vulnerabilities beyond CVE-2026-63077 itself, so a full upgrade closes far more exposure than patching a single CVE would suggest. Servers running version 2024.03 or later should already auto-download the available security patch plugin and notify administrators, but that notification still requires a human to install it. JetBrains has already shown this plugin mechanism works on older branches: when it patched CVE-2026-44413 in May 2026, the fix was backported to the same security plugin covering TeamCity 2017.1 and later. Administrators running TeamCity 2017.1 through 2018.1 need to plan for a server restart after installing the patch plugin, since those older branches do not support a hot-apply.
If You Can’t Patch Immediately
Teams that cannot upgrade on short notice should restrict TeamCity server access behind a VPN or another protective layer rather than leaving it reachable from the open internet. JetBrains has specifically warned that even exposing just the login page or REST API endpoint can give attackers the entry point they need to exploit newly disclosed vulnerabilities like this one. Network-level restriction is not optional if an upgrade has to wait.
# Check your TeamCity On-Premises version via the server REST API
curl -s https://YOUR-TEAMCITY-HOST/app/rest/server | grep -i version
# Vulnerable if the reported version is earlier than:
# 2025.11.7 (2025.x branch)
# 2026.1.3 (2026.x branch)
# If you cannot upgrade immediately:
# 1. Install the security patch plugin (available for version 2017.1+)
# 2. Restrict server access to VPN or internal network only
# 3. Never expose the login page or REST API directly to the internet
# 4. On 2024.03+, check for the auto-downloaded patch plugin noticePredictions: Where This Goes From Here
- Ransomware crews will likely fold CVE-2026-63077 into automated scanning kits within weeks. The 2024 TeamCity bugs led directly to Jasmin ransomware deployments against unpatched servers, and there is little reason to expect a different playbook now that CISA has confirmed active exploitation.
- More CI/CD and build-automation vendors will land on the KEV catalog. Attackers and researchers alike are increasingly targeting the software supply chain rather than end-user applications, and build servers are a disproportionately high-value target for the access they grant.
- Expect accelerated migration from self-hosted CI/CD toward vendor-managed cloud tiers. The contrast between an unaffected TeamCity Cloud and a three-day federal deadline for On-Premises customers is the kind of real-world case study that shows up in procurement decisions.
- JetBrains’ patch-plugin mechanism will face renewed scrutiny. Supporting a unified security patch across releases dating back to version 2017.1 shows a long-term support commitment, but it also raises the question of how many organizations are still running nine-year-old TeamCity branches in production.
- Federal remediation windows for confirmed-exploited CI/CD flaws will keep shrinking. CISA’s three-day deadline for this CVE is markedly tighter than the two-to-three week windows the agency has historically used for KEV additions, and that compression is likely to become the norm for build-pipeline vulnerabilities specifically.
- Ruby on Rails Flaw Hits CVSS 9.5, No Login Needed [2026]
- NetScaler’s 4th Bleed Flaw Exploited in 24 Hours [2026]
- CryptoJS RNG Flaw: CVSS 9.0, $5.7M Wallets Drained [2026]
- Adobe ColdFusion Zero-Day: CVSS 10.0, 2-Hour Exploit [2026]
- Tenable vs Qualys vs Rapid7: $15K-$500K Price Gap [2026]
- Verizon DBIR: Exploits Overtake Credentials at 31% [2026]
- More Cybersecurity Coverage
Frequently Asked Questions
What is CVE-2026-63077?
CVE-2026-63077 is a critical, unauthenticated remote code execution vulnerability in JetBrains TeamCity On-Premises, carrying a CVSS 3.1 score of 9.8. It allows an attacker with network access to a TeamCity server to bypass authentication and run arbitrary operating system commands via the agent polling protocol.
Is TeamCity Cloud affected by this vulnerability?
No. JetBrains has confirmed that TeamCity Cloud customers do not need to take any action, since the necessary protections were already applied to the hosted service before the advisory was published.
How do I know if my TeamCity server is vulnerable?
Any TeamCity On-Premises installation running a version earlier than 2025.11.7 or 2026.1.3 is vulnerable. Administrators can check their running version through the server’s REST API or admin console and compare it against those fixed releases.
Is CVE-2026-63077 being actively exploited?
Yes. JetBrains said it had no evidence of active exploitation when the advisory published on July 27, 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 5, 2026, a designation that requires confirmed real-world exploitation.
What should I do if I can’t upgrade TeamCity immediately?
Install the available security patch plugin if you cannot upgrade to a fixed version outright. Restrict access to the TeamCity server behind a VPN or internal network, and make sure the login page and REST API are never directly exposed to the public internet.
How does CVE-2026-63077 compare to the 2024 TeamCity vulnerabilities?
Both incidents involve critical, unauthenticated bugs in TeamCity On-Premises. The 2024 pair, CVE-2024-27198 and CVE-2024-27199, were authentication-bypass flaws that led to ransomware deployment and an estimated compromise of most exposed vulnerable servers. The 2026 flaw is a deserialization-based bug with an equally severe 9.8 CVSS score, and it reached confirmed active exploitation faster, landing on the CISA KEV catalog within nine days of public disclosure. It also arrived on the heels of a busier-than-usual patch cycle: NVD had already logged CVE-2026-65906 as affecting TeamCity versions before 2026.1.2 and 2025.11.6 just weeks earlier in July 2026, meaning CVE-2026-63077 was not an isolated event but the latest in a string of fixes JetBrains pushed through its 2025.11.x and 2026.1.x branches that year.
Who discovered CVE-2026-63077?
Researcher Antoni Tremblay privately reported the vulnerability to JetBrains on July 10, 2026, under the company’s coordinated disclosure policy, ahead of the public advisory published 17 days later.
What data can attackers access if they exploit this flaw?
Depending on server privileges, successful exploitation can expose TeamCity data, configuration files, and stored credentials. It can also let an attacker compromise build artifacts and the broader CI/CD pipeline, potentially affecting every downstream product that server builds.
Related Coverage
