The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of a critical remote code execution vulnerability in JetBrains TeamCity, adding it to the Known Exploited Vulnerabilities (KEV) catalog roughly one week after the vendor disclosed and patched the flaw.

Tracked as CVE-2026-63077 and carrying a CVSS score of 9.8, the vulnerability is a deserialization of untrusted data flaw affecting all versions of TeamCity On-Premises. TeamCity is a widely used continuous integration and continuous delivery (CI/CD) platform that automates software building and deployment across enterprise development pipelines, making it a high-value target for supply chain style attacks.

How the Flaw Works

According to JetBrains, an unauthenticated attacker can exploit the issue via the TeamCity agent polling protocol, sent through standard HTTP/S requests. Successful exploitation lets attackers bypass authentication checks entirely and execute arbitrary operating system commands with the privileges of the TeamCity server process, effectively handing over full control of the CI/CD environment.

Patch Status and Timeline

JetBrains disclosed the vulnerability last week, stating it had been reported privately and that the company was not aware of any active exploitation at the time of release. Fixes were shipped in TeamCity 2025.11.7 and 2026.1.3, and a security patch plugin was also made available for installations running version 2017.1 and later.

Despite the vendor’s initial assessment, CISA added CVE-2026-63077 to its KEV catalog on August 5, 2026, citing evidence of active exploitation. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies are required to remediate the flaw within three days. No public details on the specific attacks, threat actors, or targeted sectors have surfaced yet.

Why It Matters

CI/CD platforms like TeamCity sit at the heart of software build and release pipelines, often with access to source code, secrets, and deployment credentials. An unauthenticated RCE at this level of severity gives attackers a direct path to poisoning builds, stealing intellectual property, or pivoting deeper into enterprise networks.

CISA is urging all organizations, not just federal agencies, to prioritize patching internet-facing TeamCity On-Premises servers immediately and to review BOD 26-04 guidance on checking for prior compromise before applying patches.