# Attackers Are Actively Exploiting a Critical TeamCity RCE — Your CI/CD Pipeline Is the Target


## The Threat


CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog this week, confirming what security teams feared: active exploitation of a critical remote code execution flaw in JetBrains TeamCity is already underway. The vulnerability is a deserialization of untrusted data bug in the agent polling protocol — the communication channel that TeamCity servers use to coordinate with build agents. Because the flaw lives in that protocol layer, an unauthenticated attacker with network access to the server can reach it without any valid credentials.


The mechanics are damning. By sending crafted data over the agent polling protocol, an attacker can bypass authentication entirely and execute arbitrary operating system commands under whatever user account runs the TeamCity server process. That's not a degraded access scenario — in many deployments, the TeamCity process runs with elevated permissions, meaning successful exploitation translates directly to full host compromise.


What makes this worse is the blast radius once an attacker has a foothold. TeamCity sits at the center of software delivery for thousands of organizations — it holds build configurations, environment variables, API keys, signing certificates, and access credentials for deployment targets. A compromised TeamCity instance isn't just a compromised server; it's a launchpad into every system that server has ever touched. JetBrains confirmed that a successful attack can expose stored credentials, modify server state, and tamper with build artifacts — which means downstream software packages could be poisoned before anyone notices.


## Severity and Impact


| Field | Detail |

|---|---|

| CVE | CVE-2026-63077 |

| CVSS Score | 9.8 (Critical) |

| Vector | Network |

| Attack Complexity | Low |

| Authentication Required | None |

| CWE | CWE-502 — Deserialization of Untrusted Data |

| Exploitation Status | Actively exploited (CISA KEV confirmed) |

| Federal Patch Deadline | August 8, 2026 (BOD 26-04) |


## Affected Products


  • JetBrains TeamCity — all on-premise versions prior to the patched release

    • - Only self-hosted/on-premise deployments are affected

    - TeamCity Cloud (JetBrains-managed) is not affected


    Check your installed version against JetBrains' advisory to confirm exposure. If you haven't pinned an exact version in your deployment tooling, assume you're running something vulnerable.


    ## Mitigations


    Patch immediately. JetBrains has released a fix; on-premise operators should update to the latest version without waiting for a maintenance window. Given that exploitation is already confirmed in the wild and the attack requires no authentication, there is no low-risk reason to delay.


    If patching immediately is not operationally possible:


  • Network-segment the TeamCity server. Restrict inbound access to the agent polling port to known build agent IP ranges only. Do not expose TeamCity directly to the internet.
  • Audit the TeamCity process account. If the server runs as a high-privileged or domain account, reduce those privileges before applying the patch. Least-privilege limits the damage from any exploit, patched or not.
  • Rotate credentials stored in TeamCity. Any API keys, deployment credentials, or secrets accessible from the TeamCity server should be treated as potentially compromised if the server was internet-accessible before patching.
  • Review build artifact integrity. If you cannot rule out prior exploitation, treat recent build outputs as suspect and re-verify them from clean sources.
  • Enable audit logging and forward TeamCity logs to your SIEM. Look for anomalous process spawning, unexpected outbound connections from the build server, or authentication bypass indicators.

    • Federal Civilian Executive Branch agencies are operating under a hard deadline of August 8, 2026 per BOD 26-04 — effectively immediate.


    ## References


  • [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  • [JetBrains TeamCity Security Advisory](https://www.jetbrains.com/privacy-security/issues-fixed/)
  • [CISA BOD 26-04 — Reducing Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/binding-operational-directive-22-01)

    • ---


    ## HackWire Analysis


    This is the third critical RCE in a CI/CD platform to hit active exploitation this year, and the pattern should be forcing a structural conversation that most security teams are still deferring. TeamCity, Jenkins, GitHub Actions runners, Azure DevOps — these systems are increasingly the target of choice precisely because they are trusted, privileged, and poorly monitored. Attackers have figured out that compromising the pipeline is more reliable than compromising the endpoint.


    The deserialization vector here is particularly telling. CWE-502 is old, well-understood, and has no business appearing in a CVSS 9.8 form in 2026 — unauthenticated, network-reachable deserialization is a category of flaw that should be impossible to ship in a mature product. That it shipped, and that it's reachable via the agent polling protocol specifically, suggests the protocol layer wasn't subject to the same security scrutiny as the web UI. That's a common blind spot: organizations (and vendors) tend to treat internal service-to-service protocols as implicitly trusted, then forget to revisit that assumption when threat models change.


    The August 8 federal deadline is essentially today. But the real risk isn't federal agencies — it's the thousands of mid-market companies running TeamCity on-premise with no one dedicated to tracking vendor security bulletins. Those are the organizations likely getting hit right now. If your TeamCity server has a public IP or sits inside a flat network, assume you're being scanned. The absence of public PoC details from JetBrains doesn't mean the technique isn't circulating in threat actor tooling — it almost certainly is, given CISA's confirmation.


    Rotate your secrets. Patch the server. Treat any pre-patch build artifacts as untrusted until proven otherwise.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)