Hackers Are Actively Exploiting a Critical Flaw in JetBrains TeamCity
A software tool used by thousands of development teams worldwide has a severe security hole that attackers are already using. The US government is telling federal agencies they have three days to fix it.
Key points
- CVE-2026-63077, a critical flaw rated 9.8 out of 10 on the standard severity scale, affects all on-premises versions of JetBrains TeamCity.
- The vulnerability lets an attacker who has no username or password run any command they choose on the target server, simply by sending it a web request.
- JetBrains released fixed versions, 2025.11.7 and 2026.1.3, roughly a week before active attacks were confirmed.
- On Wednesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its official list of vulnerabilities known to be under attack.
- Federal civilian agencies must apply the patch within three days under a standing government directive called Binding Operational Directive 26-04.
JetBrains TeamCity is a platform that software development teams use to automatically build and test code before it ships. Think of it as the factory floor that turns a programmer's work into a finished product. Thousands of companies run it inside their own networks, making it a high-value target for criminals who want to break into corporate systems.
What exactly is the flaw?
The vulnerability, tracked as CVE-2026-63077, is a deserialization flaw, meaning the server can be tricked into reading specially crafted data and treating it as a trusted instruction. The result is remote code execution, which is the ability for an outside attacker to run commands on the server as if they were sitting at its keyboard.
No login is required. An attacker simply sends a crafted request over a standard web connection and can gain the same level of control as the TeamCity server process itself, including the ability to install software, steal data, or move deeper into the network.
JetBrains reported the flaw carries a CVSS score of 9.8 out of 10. CVSS, the Common Vulnerability Scoring System, is a standard industry yardstick for severity. Scores above 9.0 are considered critical.
| Detail | Information |
|---|---|
| CVE ID | CVE-2026-63077 |
| CVSS severity score | 9.8 / 10 (Critical) |
| Affected product | JetBrains TeamCity On-Premises, all versions |
| Fixed in versions | 2025.11.7 and 2026.1.3 |
| Patch plugin available | TeamCity version 2017.1 and later |
| CISA KEV listing date | Approximately one week after public disclosure |
Should organisations running TeamCity be worried?
Yes, and they should act immediately. CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog, a list of flaws that the agency has confirmed are being used in real attacks right now. Inclusion on that list is not a theoretical warning.
JetBrains originally said it had no reports of active exploitation at the time of disclosure. That changed within roughly a week of the public announcement, a common pattern where criminals study newly published flaws and begin scanning for unpatched systems almost immediately.
First reported by SecurityWeek, the attacks carry no public detail yet about which organisations have been hit or what the criminals did after getting in.
What should IT teams do right now?
Update TeamCity On-Premises to version 2025.11.7 or 2026.1.3 without delay. Organisations running older installations back to version 2017.1 can apply the standalone security patch plugin that JetBrains released alongside the main fix.
If an immediate update is not possible, restrict network access to the TeamCity server so that only authorised internal systems can reach it. Review server logs for unexpected commands or unfamiliar user activity.
For employees who are not on the IT team: this flaw does not require anyone to click a link or open an attachment. It is entirely a server-side issue. Your own devices are not directly at risk, but if your company's development environment is breached, project data and internal credentials could be exposed.
