CISA Mandates Immediate Patch for Critical TeamCity RCE Flaw

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution (RCE) vulnerability in JetBrains TeamCity to its Known Exploited Vulnerabilities (KEV) catalog. The move follows confirmation that the flaw, identified as CVE-2026-63077, is being actively exploited in the wild.

CISA listed the vulnerability on August 5, 2026, and mandated a remediation deadline of August 8, 2026. The flaw carries a severe CVSS score of 9.8, reflecting its potential for catastrophic impact. According to JetBrains, the vulnerability allows an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands.

The Technical Breakdown

The vulnerability stems from the deserialization of untrusted data via the TeamCity agent polling protocol. This allows external actors to send specially crafted data that the server processes improperly, leading to full system compromise. The flaw affects all on-premises versions of the software; JetBrains confirmed that TeamCity Cloud is not impacted.

Researcher Antoni Tremblay first reported the security hole to JetBrains on July 10, 2026. Following a period of private coordination, a public advisory was issued on July 27, 2026, to alert administrators of the risk.

Why CI/CD Servers Are High-Value Targets

As a central hub for software build and deployment automation, TeamCity is a prime target for sophisticated threat actors. These servers typically store sensitive API keys, administrative credentials, and proprietary source code, making them high-value assets for data exfiltration.

An unauthenticated RCE on such a system allows an attacker to steal secrets and modify build artifacts. This creates a critical risk of "supply chain attacks," where attackers insert backdoors into production software before it reaches customers. Furthermore, a compromised CI/CD server often serves as a beachhead, allowing attackers to pivot deeper into an organization's internal network.

Remediation and Next Steps

JetBrains has released official fixes to address the flaw in versions 2025.11.7 and 2026.1.3. For organizations running older versions, the company provided a security patch plugin compatible with versions 2017.1 and later.

Security professionals must prioritize these updates immediately given the active exploitation and the narrow window provided by CISA. Organizations should verify their current version and apply the necessary patches or plugins to prevent unauthorized access to their build pipelines.