Listen to this Post
Introduction: The Security Alarm Around TeamCity Is Getting Louder
A critical vulnerability in JetBrains TeamCity On-Premises has moved from a serious patching concern to an active exploitation problem. Tracked as CVE-2026-63077, the flaw can allow an unauthenticated remote attacker to bypass authentication and execute arbitrary operating-system commands on a vulnerable TeamCity server. JetBrains has now confirmed reports of both active and attempted exploitation against unpatched systems.
The JetBrains Blog
+1
This is especially worrying because TeamCity is not simply another web application sitting inside an organization’s network. It can sit at the heart of software development pipelines, connecting source-code repositories, build agents, credentials, artifacts, deployment systems, and production environments. A compromise of the CI/CD server can therefore become a stepping stone toward a much larger supply-chain intrusion.
The vulnerability carries a CVSS score of 9.8, with the highest-impact confidentiality, integrity, and availability ratings. NVD records the flaw as remotely exploitable with low attack complexity, no authentication requirement, and no user interaction. CISA subsequently added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on August 5, 2026, with an assessment indicating active exploitation, automation potential, and total technical impact.
NVD
The Australian Cyber Security Centre has warned organizations using TeamCity On-Premises to urgently identify vulnerable installations, patch them, and reconsider whether their TeamCity interfaces actually need to be exposed to the internet. That advice is particularly important because the flaw can be reached over HTTP(S), making internet-facing servers especially attractive targets.
What Is TeamCity and Why Does Its Compromise Matter?
The Engine Behind Software Delivery
TeamCity is
A Compromised Build Server Can Become a Supply-Chain Gateway
If an attacker gains control of a CI/CD server, the consequences can extend well beyond that machine. Depending on configuration and privileges, attackers may gain access to build configurations, stored credentials, source-code integrations, artifacts, deployment secrets, and other systems connected to the pipeline.
JetBrains specifically warns that exploitation of CVE-2026-63077 could expose TeamCity data, configurations, and stored credentials, modify server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines.
The JetBrains Blog
The Real Risk Is Trust
This is what makes CI/CD vulnerabilities particularly dangerous. Developers and automated deployment systems inherently trust the infrastructure that produces software.
If that infrastructure is compromised, an attacker may not need to attack every downstream system individually. Instead, they can attempt to abuse the trusted development and deployment process itself.
CVE-2026-63077: What Makes the Vulnerability So Dangerous?
Authentication Can Be Bypassed
CVE-2026-63077 is an unauthenticated remote code execution vulnerability in TeamCity On-Premises. According to JetBrains and NVD, an attacker with HTTP(S) access can exploit the TeamCity agent polling protocol to bypass authentication and execute operating-system commands with the privileges of the TeamCity server process.
The JetBrains Blog
+1
No Credentials Are Required
One of the most alarming characteristics is the absence of a prerequisite login.
The attacker does not first need a legitimate TeamCity account. There is no requirement for an administrator to click a malicious link, approve an authentication request, or interact with the attacker.
That dramatically reduces the barrier to exploitation.
The CVSS Score Reflects the Potential Impact
The vulnerability has a CVSS v3.1 score of 9.8, classified as critical. Its vector indicates network accessibility, low attack complexity, no privileges required, no user interaction, and high impact across confidentiality, integrity, and availability.
OpenCVE
Remote Code Execution Changes the Equation
Authentication bypasses can already be serious, but arbitrary code execution takes the risk much further.
An attacker who reaches the vulnerable service may potentially execute commands under the privileges available to the TeamCity server process. The actual impact therefore depends heavily on how the server is configured and what permissions its operating-system account possesses.
Active Exploitation Has Now Been Confirmed
JetBrains Changed the Threat Picture
When JetBrains initially disclosed CVE-2026-63077 in July, the company stated that it was not aware of active exploitation at that time. That situation has since changed.
In its August follow-up advisory, JetBrains said it had received reports of active exploitation and attempted exploitation targeting unpatched TeamCity servers.
The JetBrains Blog
CISA Added the Vulnerability to KEV
The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on August 5.
NVD’s record shows the CISA assessment was updated to identify exploitation as active, with the vulnerability considered automatable and capable of producing total technical impact.
NVD
This Is No Longer a “Patch When Convenient” Vulnerability
The difference between a theoretical vulnerability and an actively exploited vulnerability is enormous.
Organizations that postponed the update because their TeamCity server was internal, because they had other patching priorities, or because they believed exploitation was unlikely should reconsider that decision immediately.
Which TeamCity Versions Are Vulnerable?
All On-Premises Versions Were Initially Affected
JetBrains’ original advisory stated that all TeamCity On-Premises versions were affected by CVE-2026-63077. The vulnerability was fixed in TeamCity 2025.11.7 and 2026.1.3.
The JetBrains Blog
NVD Clarifies the Affected Version Ranges
NVD lists versions before 2025.11.7 and versions from 2026.1 through versions before 2026.1.3 as affected.
NVD
TeamCity Cloud Is Different
Organizations using TeamCity Cloud do not need to perform the same server-side remediation because JetBrains says the necessary protections have already been applied to the cloud service.
The JetBrains Blog
+1
That distinction is important because administrators should first determine whether their environment is actually running TeamCity On-Premises before beginning an emergency server upgrade.
Patch Immediately: The Official Fixes
Upgrade to TeamCity 2025.11.7
For organizations on the 2025.11 branch, JetBrains recommends upgrading to 2025.11.7.
Upgrade to TeamCity 2026.1.3
For organizations using the 2026.1 branch, the fixed release is 2026.1.3.
JetBrains’ release announcement says these maintenance versions also address more than 20 security vulnerabilities in each release, making the upgrade valuable beyond CVE-2026-63077 alone.
The JetBrains Blog
Use the Security Patch Plugin If You Cannot Upgrade
JetBrains also provides a security patch plugin for TeamCity 2017.1 and later for organizations that cannot immediately perform the full upgrade.
However, JetBrains stresses that the plugin addresses this specific vulnerability and that upgrading remains the preferred solution because newer releases contain additional security fixes.
The JetBrains Blog
+1
Internet Exposure Is a Major Part of the Risk
Ask a Simple Question
Does your TeamCity server really need to be accessible from the public internet?
If the answer is no, removing unnecessary internet exposure can significantly reduce the attack surface.
Internal Does Not Automatically Mean Safe
A common mistake is assuming that an internal TeamCity server is harmless because it is not directly accessible from the internet.
Attackers who compromise another machine inside an organization may be able to move laterally toward the CI/CD environment.
Put CI/CD Behind Strong Network Controls
JetBrains recommends limiting TeamCity access to trusted networks wherever possible. For internet-facing installations, the company recommends considering VPN access or another additional security layer.
The JetBrains Blog
+1
Deep Analysis: Understanding the Attack Surface
The Agent Polling Protocol Matters
CVE-2026-63077 is associated with
The JetBrains Blog
+1
The Server Process Privileges Matter
Remote code execution does not automatically mean unrestricted root or administrator access.
The attacker receives the privileges available to the TeamCity server process. This is why running TeamCity with the minimum required operating-system privileges is an important defensive control.
Check the Running Version
Administrators should first establish exactly which TeamCity version is running.
A basic Linux check for a service process can include:
ps aux | grep -i teamcity
Search Configuration and Installation Paths
Depending on the deployment, administrators can inspect common TeamCity directories:
find / -maxdepth 4 -type d -iname "teamcity" 2>/dev/null
Check Listening Network Services
To determine whether the server is exposing TeamCity-related services:
ss -lntp
or:
sudo ss -lntp
Check Firewall Exposure
On Linux systems using UFW, administrators can review current rules with:
sudo ufw status verbose
For environments using firewalld:
sudo firewall-cmd --list-all
Review TeamCity Logs
JetBrains has provided a particularly useful investigation clue. Administrators can search TeamCity server logs for:
com.thoughtworks.xstream.converters.ConversionException
JetBrains says this message alone does not prove exploitation, but it may indicate an attempted or successful exploit and should trigger further investigation.
The JetBrains Blog
Check for Post-Patch Indicators
After applying the security patch or upgrading, administrators can also investigate occurrences of:
com.thoughtworks.xstream.security.ForbiddenClassException
Again, this should be treated as an investigation signal rather than definitive proof of compromise.
The JetBrains Blog
Do Not Treat Logs as Your Only Evidence
If exploitation is suspected, defenders should correlate TeamCity logs with reverse-proxy logs, firewall records, endpoint telemetry, authentication events, process execution data, and outbound network activity.
Investigate Credentials
Because a compromised TeamCity server may contain credentials and secrets used by automated pipelines, organizations should consider rotating sensitive credentials if there is credible evidence of compromise.
Investigate Build Artifacts
Security teams should also examine build histories and artifacts for unexpected modifications.
A compromised CI/CD server can potentially affect the integrity of software produced by the pipeline.
Separate TeamCity From Build Agents
JetBrains recommends running the TeamCity server on dedicated hosts separate from build agents. This separation can reduce the blast radius if one component is compromised.
The JetBrains Blog
Why CI/CD Servers Are So Attractive to Attackers
They Are High-Value Infrastructure
Attackers increasingly understand that compromising development infrastructure can be more profitable than attacking an ordinary workstation.
They Often Hold Secrets
CI/CD platforms may interact with Git repositories, cloud accounts, package registries, deployment systems, container registries, signing infrastructure, and production environments.
They Have Automation Privileges
Automation is useful to developers—and potentially useful to attackers.
A compromised pipeline can provide an attacker with powerful capabilities that would otherwise require numerous individual compromises.
They Can Become Supply-Chain Launchpads
This is the nightmare scenario: an attacker compromises the system responsible for building trusted software and then attempts to manipulate what downstream users or systems receive.
That does not mean every TeamCity compromise automatically becomes a supply-chain attack. But the architecture makes such escalation a realistic concern.
TeamCity Has Been Targeted Before
The 2024 Incidents Were a Warning
The current vulnerability is not the first serious TeamCity security crisis.
In March 2024, attackers rapidly exploited CVE-2024-27198, a critical authentication bypass vulnerability that could allow unauthenticated attackers to take complete control of vulnerable TeamCity servers. CERT-EU documented the issue and recommended immediate upgrading.
CERT-EU
Attackers Moved Quickly
Security researchers observed exploitation shortly after the 2024 disclosure. Reports linked exploitation to ransomware activity, cryptomining, Cobalt Strike, and other malicious payloads.
SecurityWeek
+1
Another Critical Flaw Appeared Earlier in 2024
JetBrains also disclosed CVE-2024-23917, another critical TeamCity On-Premises vulnerability that could allow an unauthenticated attacker to bypass authentication and gain administrative control.
The JetBrains Blog
The Pattern Is Difficult to Ignore
The historical record demonstrates why defenders should treat TeamCity vulnerabilities as high-priority events.
A critical flaw appears, public information becomes available, attackers scan for exposed installations, vulnerable servers are compromised, and organizations that delayed patching can become victims.
The Difference Between 2024 and 2026
Attackers Have More Experience
The security ecosystem has changed considerably since the major TeamCity attacks of 2024.
Attackers have become increasingly automated, while vulnerability intelligence, scanning infrastructure, botnets, and exploit development have continued to accelerate.
Exposure Can Be Discovered Quickly
A vulnerable internet-facing TeamCity server does not necessarily remain hidden for long.
Automated scanners can continuously search for exposed services and vulnerable versions.
Patch Windows Are Shrinking
Organizations once had days or weeks to react to a newly disclosed vulnerability.
For actively exploited internet-facing infrastructure, that assumption is increasingly dangerous.
What Organizations Should Do Right Now
Step One: Identify Every TeamCity Server
Inventory production, development, testing, disaster-recovery, and forgotten legacy environments.
Step Two: Determine Whether They Are On-Premises
Do not confuse TeamCity Cloud with TeamCity On-Premises.
Step Three: Check the Version
Anything below the fixed releases should immediately receive attention.
Step Four: Upgrade
Move to 2025.11.7 or 2026.1.3, as appropriate, or apply JetBrains’ security patch plugin if an immediate upgrade is impossible.
The JetBrains Blog
+1
Step Five: Restrict Network Access
If the server does not need public exposure, remove that exposure.
Step Six: Search the Logs
Look for suspicious activity and the indicators identified by JetBrains.
Step Seven: Rotate High-Value Credentials if Needed
If compromise cannot be ruled out, credentials accessible from the server should be treated carefully.
Step Eight: Inspect Build Integrity
Review unusual builds, artifacts, configuration changes, administrative accounts, and deployment activity.
Step Nine: Examine Connected Systems
Investigate source repositories, cloud environments, package registries, deployment servers, and build agents connected to the TeamCity instance.
Step Ten: Preserve Evidence
If compromise is suspected, avoid destroying evidence through uncontrolled cleanup. Preserve relevant logs, disk images, process information, and network telemetry for investigation.
What Undercode Say:
1. The Vulnerability Is Serious
CVE-2026-63077 deserves emergency treatment because it combines unauthenticated access with remote code execution.
- The 9.8 Score Is Not the Most Important Detail
The more important fact is that exploitation is now being reported in the wild.
3. CISA KEV Changes the Priority
Being listed in the KEV catalog means defenders should treat the vulnerability as an actively exploited weakness rather than a theoretical risk.
NVD
4. Internet Exposure Is Dangerous
An internet-facing CI/CD platform creates an obvious external attack surface.
5. But Internal Systems Matter Too
A TeamCity server does not have to be public to become part of an attack chain.
6. CI/CD Is High-Trust Infrastructure
The server can influence how software is built, tested, packaged, and deployed.
7. That Makes Its Credentials Valuable
Secrets stored or accessible through CI/CD systems can potentially unlock additional infrastructure.
8. Build Agents Increase the Blast Radius
A compromised controller connected to powerful build agents can create additional opportunities for lateral movement.
9. Least Privilege Is Essential
The TeamCity process should have only the permissions it genuinely requires.
10. Network Segmentation Matters
CI/CD infrastructure deserves its own security boundaries rather than being treated like an ordinary application server.
11. Patching Alone Is Not Enough
A vulnerable server should be patched, but its surrounding architecture should also be reviewed.
12. Exposure Should Be Minimized
If developers can safely access TeamCity through a VPN, private network, or zero-trust gateway, public exposure may be unnecessary.
13. Logging Becomes Critical
Without sufficient telemetry, determining whether a TeamCity server was attacked can become extremely difficult.
14. Administrators Should Assume Attackers Scan
Once a critical vulnerability becomes public, automated discovery can happen quickly.
15. Security Teams Need Asset Visibility
You cannot patch a server you do not know exists.
16. Forgotten Development Servers Are Dangerous
Old test and staging environments frequently become overlooked entry points.
17. Old Versions Create Concentrated Risk
Legacy installations can remain exposed long after the organization has forgotten why they exist.
- The 2024 TeamCity Attacks Were a Warning
Previous TeamCity vulnerabilities were exploited rapidly after disclosure.
SecurityWeek
+1
- History Makes the Current Situation More Concerning
Organizations already familiar with TeamCity vulnerabilities should not underestimate this latest campaign.
20. Attackers Understand Developer Infrastructure
Modern threat actors increasingly recognize the value of CI/CD systems.
21. Supply-Chain Risk Is the Bigger Story
The danger is not limited to stealing information from the TeamCity server.
22. Software Integrity Is Also at Stake
A compromised build environment can potentially alter what software organizations produce.
23. Secrets Can Become Secondary Targets
Credentials discovered on a compromised server can enable additional attacks.
24. Cloud Access Is Especially Sensitive
CI/CD environments frequently connect to cloud platforms with powerful automation permissions.
25. Deployment Tokens Deserve Attention
A compromised deployment credential could potentially move an attacker closer to production systems.
26. Security Teams Should Review Trust Relationships
Every connection from TeamCity to another system should be evaluated.
27. Build Agents Should Not Be Overprivileged
Agents should not have unrestricted access to infrastructure simply because automation is convenient.
28. Administrative Access Should Be Restricted
TeamCity administration should be limited to authorized personnel and trusted networks.
- MFA Helps, But It Cannot Fix This Vulnerability
Because exploitation does not require authentication, adding MFA to ordinary user logins does not eliminate the underlying flaw.
30. Network Controls Therefore Matter
Restricting who can reach the vulnerable service can provide another layer of defense.
31. Incident Response Plans Should Include CI/CD
Development infrastructure should be explicitly covered in breach-response procedures.
32. Credential Rotation Should Be Planned
Organizations should already know which credentials could require emergency rotation after a CI/CD compromise.
33. Artifact Verification Matters
Software produced after a suspected compromise deserves additional scrutiny.
- Security Monitoring Should Extend to Build Pipelines
Unexpected builds, new administrators, altered configurations, and unusual deployments can all provide valuable signals.
- “We Are Not a Government Agency” Is Not a Defense
CISA’s KEV catalog is particularly relevant to federal agencies, but the underlying threat applies to private organizations as well.
36. The ACSC Warning Expands the Audience
Australian organizations using vulnerable TeamCity On-Premises installations have been specifically urged to investigate and patch.
- Attackers Do Not Need to Know Your Industry
The absence of evidence of a specific sector being targeted does not make an exposed server safe.
38. Automation Makes Opportunistic Attacks Possible
Attackers can target vulnerable technology rather than carefully selecting individual companies.
39. The Best Defense Is Fast Remediation
Patch, restrict access, investigate, and rotate credentials when compromise is suspected.
40. TeamCity Administrators Should Act Now
The most dangerous response to an actively exploited vulnerability is assuming that someone else will become the victim first.
✅ CVE-2026-63077 Is a Critical 9.8 Vulnerability
This claim is accurate. NVD records CVE-2026-63077 with a CVSS v3.1 score of 9.8 and describes unauthenticated remote code execution through the TeamCity agent polling protocol.
NVD
+1
✅ Active Exploitation Has Been Confirmed
This is accurate and especially important. JetBrains has reported both active and attempted exploitation against unpatched TeamCity servers, while CISA’s KEV information identifies active exploitation.
The JetBrains Blog
+1
✅ The Recommended Fixed Versions Are Correct
JetBrains identifies 2025.11.7 and 2026.1.3 as fixed releases for CVE-2026-63077. A security patch plugin is also available for older TeamCity versions when an immediate upgrade is not possible.
The JetBrains Blog
+1
❌ The Original ‘s Timeline Needs Updating
The claim that JetBrains only issued its follow-up because of exploitation reports is broadly correct, but the current timeline is more precise: JetBrains’ original disclosure was published July 27, 2026, and its follow-up on August 7 reported active and attempted exploitation.
The JetBrains Blog
+1
❌ The Historical TeamCity Section Is Too Vague
The statement that two vulnerabilities were “extensively exploited” in 2024 is directionally accurate, but the underlying incidents can be identified more precisely as CVE-2024-27198 and CVE-2024-27199. CVE-2024-27198 was actively exploited and entered CISA’s KEV catalog.
CERT-EU +1
⚠️ The Nation-State Claim Requires Context
TeamCity has previously attracted attention from Russian-linked threat actors, but broad statements that a particular 2023 vulnerability was targeted by both Russian and North Korean state actors should be presented cautiously unless supported by a specific primary-source attribution. The documented 2024 TeamCity exploitation history is much stronger and easier to verify.
TechTarget
Prediction
(+1) Emergency Patching Will Accelerate Across TeamCity Deployments
With active exploitation confirmed and CVE-2026-63077 present in CISA’s KEV catalog, organizations running exposed TeamCity On-Premises servers are likely to accelerate emergency patching, vulnerability scanning, and network restrictions.
(+1) Internet-Facing TeamCity Servers Will Receive More Security Scrutiny
Security teams are likely to reassess whether TeamCity needs direct public exposure at all. VPNs, private networking, reverse proxies, access gateways, and segmentation will increasingly become standard defensive controls around CI/CD infrastructure.
(+1) CI/CD Security Will Become a Larger Enterprise Priority
The incident reinforces a broader trend already visible across cybersecurity: attackers are increasingly interested in development systems, package registries, source-code infrastructure, build pipelines, and automation platforms.
(-1) Unpatched Legacy TeamCity Servers Will Remain Attractive Targets
Organizations that operate old development environments or forgotten TeamCity installations may remain vulnerable for weeks or months, creating opportunities for attackers after the initial wave of exploitation.
(-1) Compromised Servers Could Produce Long-Term Supply-Chain Risk
If attackers obtain persistent access to a CI/CD environment, the consequences could continue even after the original vulnerability is patched. Malicious changes, stolen credentials, modified build configurations, or compromised artifacts may survive unless defenders conduct a full investigation.
(+1) The Most Effective Defense Will Be Layered Security
The organizations best positioned to withstand this campaign will not rely on a single patch. They will combine rapid updates, restricted network access, least privilege, segmentation, strong logging, credential protection, build integrity controls, and continuous monitoring.
Final Takeaway: Patch the Server Before the Attacker Builds the Next Step
This Is Bigger Than One CVE
CVE-2026-63077 is a serious vulnerability on its own, but its importance becomes much clearer when viewed through the role TeamCity plays in modern software development.
A vulnerable CI/CD server can sit at the intersection of developers, source code, build systems, credentials, artifacts, cloud infrastructure, and deployment pipelines. That makes it an exceptionally valuable target.
The Window for Delay Is Closing
JetBrains has released fixes. A security patch plugin is available for organizations that cannot immediately upgrade. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog. And JetBrains has confirmed active exploitation against unpatched servers.
The JetBrains Blog
+1
The Right Response Is Straightforward
Identify every TeamCity On-Premises installation. Determine its version. Upgrade to a fixed release or apply the security patch plugin. Remove unnecessary internet exposure. Review logs for suspicious activity. Investigate connected systems and rotate sensitive credentials if compromise is suspected.
CI/CD Infrastructure Deserves Production-Level Security
Development servers are no longer harmless back-office tools. They increasingly control the path from source code to production.
When attackers find a vulnerability that provides unauthenticated command execution inside that environment, the consequences can extend far beyond one server.
For organizations running TeamCity On-Premises, CVE-2026-63077 should be treated as an emergency security issue—not a routine update waiting for the next maintenance window.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
