TeamCity CVE-2026-63077 RCE exploited in attacks

What Happened

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added JetBrains TeamCity CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The flaw, a critical remote code execution (RCE) vulnerability, affects on-premise versions of the popular CI/CD server. JetBrains has released a patch, but the window between disclosure and weaponization appears to have been short, with threat actors already launching attacks against unpatched instances.

Why It Matters

TeamCity is a cornerstone of software development pipelines for thousands of organizations, including government agencies, financial institutions, and technology companies. A successful RCE on a build server grants attackers a privileged foothold inside the corporate network. From there, they can inject malicious code into build artifacts, steal source code, exfiltrate credentials stored in the CI/CD environment, or pivot to other internal systems. Because build servers often hold service accounts with broad permissions, the blast radius of this vulnerability extends far beyond the single host.

Technical Details

CVE-2026-63077 is an authentication bypass flaw that allows an unauthenticated attacker to execute arbitrary code on a vulnerable TeamCity server. The vulnerability exists in the on-premise version of the software and stems from improper handling of specific HTTP requests. Successful exploitation requires no user interaction, making it highly attractive for automated scanning and mass exploitation campaigns.

The flaw was patched in a recent JetBrains security update. Organizations running affected on-premise versions should treat this as an emergency and apply the patch immediately. Indicators of compromise may include unexpected processes spawned by the TeamCity service account, outbound connections to unknown IP addresses from the build server, or the creation of suspicious files in the TeamCity installation directory. CISA has not yet released technical exploit details, but given the active exploitation, public PoC code is likely imminent if not already circulating.

Immediate Risk

The risk is critical. Once CISA adds a vulnerability to the KEV catalog, federal agencies are required to patch within a mandatory timeframe, typically 30 days or fewer. However, for non-government organizations, the urgency is equally high. Threat actors are already exploiting this flaw, and the barrier to entry is low. Security teams should assume any internet-exposed, unpatched TeamCity instance is compromised and conduct a thorough forensic review before applying the patch to avoid overwriting evidence.

Organizations that cannot patch immediately should restrict network access to TeamCity servers, implement Web Application Firewall (WAF) rules if available, and monitor for the IOCs mentioned above. If compromise is suspected, assume lateral movement has occurred and expand the investigation accordingly.

Security Insight

The speed from patch release to active exploitation in this case highlights a recurring problem in CI/CD security: the assumption that build servers are internal tools with limited exposure. Many organizations fail to segment these systems or treat them with the same sensitivity as production infrastructure. This incident should be a catalyst for reevaluating that posture. Build servers are effectively the keys to the software supply chain, and they should be isolated, monitored, and patched with the same rigor as any externally facing critical asset. Consider this a warning: the next RCE in a CI/CD tool may not be announced by CISA before attackers weaponize it.

Further Reading

• TeamCity RCE exploited in the wild (CVE-2026-63077) [PoC]
• Latest Security News
• CVE Advisories
• Data Breach Reports