Hackers Are Actively Exploiting a Critical Flaw in JetBrains TeamCity
A software tool used by thousands of development teams has a severe security hole that attackers are already using. The US government is giving federal agencies three days to fix it.
Key points
- CVE-2026-63077, a critical flaw rated 9.8 out of 10 on the standard severity scale, affects all on-premises versions of JetBrains TeamCity.
- The vulnerability lets an attacker with no credentials run any command they choose on the target server by sending it a web request.
- JetBrains released fixed versions 2025.11.7 and 2026.1.3 roughly a week before active attacks were confirmed.
- On Wednesday, CISA added the flaw to its official list of vulnerabilities known to be under attack.
- Federal civilian agencies must patch within three days under Binding Operational Directive 26-04.
JetBrains TeamCity is a platform that software development teams use to automatically build and test code before it ships. Think of it as the factory floor that turns a programmer's work into a finished product. Thousands of companies run it inside their own networks, making it a high-value target for anyone who wants to break into corporate systems.
What exactly is the flaw?
CVE-2026-63077 is a deserialization flaw, meaning the server can be tricked into reading specially crafted data and treating it as a trusted instruction. The consequence is remote code execution: an outside attacker can run commands on the server as if seated at its keyboard. No login is required. Send a crafted request over a standard web connection and you can gain the same control as the TeamCity server process itself, including the ability to install software or steal data.
We first covered this vulnerability on 28 July 2026, when JetBrains issued its patch and noted that cloud customers were fixed automatically. On-premises administrators had no such luck.
JetBrains' advisory also warned that an unauthenticated attacker could exploit the flaw through the TeamCity agent polling protocol, a background channel used by build agents to check in with the server.
| Detail | Information |
|---|---|
| CVE ID | CVE-2026-63077 |
| CVSS severity score | 9.8 / 10 (Critical) |
| Affected product | JetBrains TeamCity On-Premises, all versions |
| Fixed in versions | 2025.11.7 and 2026.1.3 |
| Patch plugin available | TeamCity version 2017.1 and later |
| CISA KEV listing date | Approximately one week after public disclosure |
Should organisations running TeamCity be worried?
Yes, and they should act immediately. CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog, a list of flaws the agency has confirmed are being used in real attacks right now. Inclusion isn't a theoretical warning.
JetBrains originally said it had no reports of active exploitation at the time of disclosure. That changed within roughly a week of the public announcement. It's a familiar pattern: criminals study newly published flaws and begin scanning for unpatched systems almost immediately. As SecurityWeek reported, no public detail has emerged yet about which organisations were hit or what the attackers did after getting in.
What should IT teams do right now?
Update TeamCity On-Premises to version 2025.11.7 or 2026.1.3 without delay. Organisations running older installations back to version 2017.1 can apply the standalone security patch plugin JetBrains released alongside the main fix.
If an immediate update isn't possible, restrict network access to the TeamCity server so that only authorised internal systems can reach it. Review server logs for unexpected commands or unfamiliar user activity.
For employees outside the IT team: this flaw doesn't require anyone to click a link or open an attachment. It's entirely a server-side issue. Your own devices aren't directly at risk, but a breach of your company's development environment could expose project data or internal credentials. That's the part to watch.
