The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially incorporated a critical vulnerability affecting JetBrains TeamCity, identified as CVE-2026-63077, into its Known Exploited Vulnerabilities (KEV) catalog. According to Security Affairs, the flaw carries a CVSS score of 9.8, indicating the highest level of severity for an unauthenticated remote code execution risk.
JetBrains issued security updates for TeamCity On-Premises at the end of July to address the vulnerability. The security defect allows an unauthenticated actor with HTTP(S) access to a targeted server to bypass authentication protocols and initiate arbitrary operating system commands. This exploit capability extends to instances using the agent polling protocol, potentially granting unauthorized access to credentials, sensitive configuration data, and the ability to compromise CI/CD pipelines.
While TeamCity Cloud instances have received automatic remediation, all on-premise versions remain vulnerable until updated. For those unable to perform an immediate upgrade, the manufacturer has released a specific security patch plugin compatible with TeamCity 2017.1 and later versions. However, JetBrains emphasizes that full server updates provide the most comprehensive protection against broader security risks.
Technical Remediation Data
| Attribute | Specification |
|---|---|
| CVE Identifier | CVE-2026-63077 |
| CVSS Severity Score | 9.8 |
| Recommended Update (Option 1) | 2025.11.7 |
| Recommended Update (Option 2) | 2026.1.3 |
| Patch Plugin Eligibility | TeamCity 2017.1 and newer |
Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are mandated to remediate vulnerabilities listed in the CISA catalog by specified deadlines to maintain network integrity. CISA strongly encourages private sector organizations to align their internal patching schedules with these regulatory security standards.
Why It Matters
The integration of CVE-2026-63077 into the KEV catalog signifies a shift in how CISA prioritizes software supply chain security. Because TeamCity functions as the backbone of automated development pipelines, a successful compromise effectively grants attackers the 'keys to the kingdom.' By infiltrating build servers, malicious actors do not just steal data; they gain the ability to inject malicious code into downstream software products distributed to enterprise clients. This reflects a broader trend where attackers increasingly target the developer infrastructure to achieve large-scale software supply chain compromises.
Reader Discussion & Insights