CISA added CVE-2026-63077, a critical deserialization-of-untrusted-data flaw in JetBrains TeamCity rated 9.8 on the CVSS scale, to its Known Exploited Vulnerabilities catalog, citing confirmed exploitation in the wild. The agency says the bug allows an unauthenticated attacker to bypass authentication and execute arbitrary operating-system commands with the privileges of the TeamCity server process over the agent polling protocol.
What CVE-2026-63077 Allows in an On-Premises TeamCity Server
JetBrains has confirmed the flaw can be exploited without authentication through the agent polling protocol. The deserialization-of-untrusted-data bug lets an unauthenticated attacker bypass authentication checks and execute arbitrary operating-system commands with the privileges of the TeamCity server process. Because TeamCity is widely deployed in enterprise CI/CD, an attacker who reaches an internet-exposed on-premises server can access data, configurations, and stored credentials, modify server state, and potentially compromise build artifacts and downstream CI/CD pipelines. The impact depends on the privileges the server process runs with, but the failure sits on the critical path to source code and deployment credentials.
The Patch Versions and the Scope of Affected Installations
The vulnerability affects all TeamCity On-Premises versions and is fixed in 2025.11.7 and 2026.1.3, with a security patch plugin available for installations running 2017.1 and later. JetBrains had not updated its advisory to confirm active exploitation at the time CISA listed the flaw; the bug was reported privately, and the vendor was not aware of in-the-wild use when it shipped the patch.
What CISA’s KEV Addition Means for Federal Agencies
The KEV entry creates an immediate compliance deadline: federal civilian executive branch agencies must patch by August 8 under Binding Operational Directive 26-04. The catalog addition marks a new phase of the incident, moving the story from a patch disclosure to a confirmed exploitation event. CISA’s entry notes it is not yet known how the flaw is being exploited in the wild, who the actors are, or the scale of activity, and JetBrains has not confirmed in-the-wild use itself. The catalog listing is therefore the earliest authoritative signal that attackers are moving against the flaw, before the vendor has publicly acknowledged active exploitation.
Why TeamCity Exploitation Is a Supply-Chain Concern
TeamCity sits in the build pipeline that produces software artifacts, so an unauthenticated RCE on a server in that role is not limited to the machine itself. An attacker with control of the TeamCity process can reach build artifacts, source code, and the deployment credentials the pipeline uses, which turns a single server compromise into a supply-chain foothold. The polling protocol that agents use to pull work is the same channel CISA and JetBrains describe as the unauthenticated attack surface, which means the build orchestration that enterprises trust to produce their software is directly exposed when the server is reachable.
The Patching Burden and the CI/CD Risk Profile
Organizations running TeamCity On-Premises that have not applied 2025.11.7 or 2026.1.3 are facing the same unauthenticated RCE exposure that CISA has now confirmed is under attack, and the build-server role of the software means the failure is a direct supply-chain risk rather than an ordinary server flaw. The KEV listing changes the calculation for security teams that were tracking the advisory as a proactive fix: it is now a mandatory-patch event with a federal deadline, and the catalog entry stands as the earliest official signal that attackers are moving against the flaw. The exposure window between the patch disclosure and the KEV confirmation highlights how quickly an unpatched CI server becomes an attractive target, and the broader pattern is consistent with recent attention on CI/CD platforms, where a compromise at the build layer can feed malicious code into the software supply chain.
