Unattributed. The CISA catalogue entry reads «knownRansomwareCampaignUse: Unknown» and names no groupcritical
The software factory that runs a stranger's commands: CVE-2026-63077 in TeamCity
CVE-2026-63077 lets an unauthenticated attacker who can reach a TeamCity On-Premises server over HTTP bypass authentication checks and execute operating system commands with the privileges of the server process. CVSS 3.1 of 9.8. JetBrains fixed it in versions 2025.11.7 and 2026.1.3 and released a security patch plugin for older installations. On 5 August 2026 CISA added it to the catalogue of vulnerabilities that are actually being exploited, with a remediation deadline of 8 August — after JetBrains had written in its own advisory that it was not aware of active exploitation. The target is not a website: it is the system that builds and signs the software of whoever runs it.
What kind of machine we are talking about
TeamCity is a continuous integration and delivery server. In practice: it is the corporate computer that, every time a developer submits code, takes it, compiles it, runs the tests, packages the result and — very often — publishes it to wherever the software actually runs.
To do that job it needs two things that make it a particular kind of target. The first is credentials: repository keys, container registry tokens, production server passwords, signing certificates. A build server that cannot reach anything is useless. The second is downstream trust: the package that comes out of it gets installed without suspicion, because it is the company's official package.
Whoever takes control of a build server has not compromised a website. They have compromised the assembly line.
What happened
On 10 July 2026, according to the JetBrains advisory, researcher Antoni Tremblay privately reported a vulnerability in TeamCity On-Premises, following the company's coordinated disclosure policy. The flaw was assigned the identifier CVE-2026-63077.
The technical description published by JetBrains is spare, and worth reading in full: «An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process».
Three elements in a single line. No authentication required. The channel used is the protocol build agents use to poll the server — an internal service channel, not the interface people talk to. And the outcome is not reading a file: it is operating system commands, with the privileges the server process runs under.
The NVD description is shorter still: «In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol». The score assigned by the JetBrains CNA and recorded by NVD is CVSS 3.1 of 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: over the network, low complexity, no privileges, no user interaction, high impact on confidentiality, integrity and availability. The NVD record is in Analyzed state.
- 10 July 2026The report
Antoni Tremblay reports the flaw to JetBrains under coordinated disclosure.
- 27 July 2026Publication
The CVE-2026-63077 record appears on NVD with CVSS 9.8.
- 5 August 2026Into CISA KEV
The CVE enters the catalogue of vulnerabilities actually being exploited.
- 8 August 2026The deadline
Remediation date set by CISA for US federal agencies.
The point worth stating in full
In its advisory, JetBrains writes: «At the time of publishing this advisory, we are not aware of any active exploitation of this vulnerability». That is a correct and honest sentence — it describes what the vendor knew at the moment of publication.
A few days later, CISA added the same CVE to the Known Exploited Vulnerabilities catalogue. That catalogue does not list theoretically dangerous vulnerabilities: it lists vulnerabilities for which there is evidence of real-world exploitation. The entry reads dateAdded: 2026-08-05, dueDate: 2026-08-08, cwes: ["CWE-502"], knownRansomwareCampaignUse: "Unknown".
The two statements do not contradict each other: they are two photographs taken at different moments. Together, though, they say something practical, and it is not the first time this site has observed it on a different case: «no known exploitation» is information with a very short shelf life, and it is not a criterion for deferring an update. On an unauthenticated flaw scoring 9.8, the window between advisory publication and the first real attempts is measured in days.
One discrepancy is worth flagging, because anyone comparing the sources will see it: CISA classifies the vulnerability under CWE-502, «Deserialization of Untrusted Data», and titles the entry JetBrains TeamCity Deserialization of Untrusted Data Vulnerability. JetBrains, in its own advisory, describes a bypass of authentication checks and command execution, without using the word deserialization. The two readings are compatible — unsafe deserialization is a classic way to achieve exactly that effect — but the internal mechanism has not been publicly described in detail, and we are not reconstructing it by guesswork.
Why the damage does not stop at the server that was hit
JetBrains describes the consequences explicitly: «a successful attack could expose TeamCity data, configurations, and stored credentials, modify server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines».
The last five words are the part that matters. The integrity of build artifacts. If someone can run commands on the server that compiles your software, they can do two very different things: steal the credentials they find — bad, but bounded, and credentials can be rotated — or modify what the server produces. In the second case the signed package leaving the pipeline is genuine from the recipient's point of view: right source, right signature, right server. There is just something extra inside it.
It is the same mechanism seen in other software supply chain compromises: whoever verifies provenance sees a green tick, because the provenance genuinely is what it claims. Provenance certifies where a package was built, not what was put into it during the build.
- 01Unauthenticated accessthe agent polling protocol is reachable over HTTP(S)
- 02Command executionwith the privileges of the TeamCity server process
- 03Credentials and artifactstokens, keys and signatures in memory; and what the pipeline ships downstream
What to do, in order
Update to 2025.11.7 or 2026.1.3. These are the versions containing the fix. JetBrains recommends upgrading as the first option, not least because it brings other security updates with it.
If you cannot upgrade, install the security patch plugin. JetBrains has released it for TeamCity 2017.1 and later. From version 2024.03 onwards the server downloads available security patch plugins by itself and notifies administrators, if notifications are configured: they are under Administration | Updates, in Available security updates. Versions 2017.1 to 2018.1 need a server restart; from 2018.2 the plugin can be enabled without one. Note the stated limit: «The security patch plugin will address only the vulnerability described above».
If you use TeamCity Cloud, there is nothing to do. JetBrains writes that the necessary measures have already been applied and that there is no evidence of Cloud environments being exploited through this vulnerability.
Take the server off direct internet exposure. This is what JetBrains recommends as a longer-term practice, and it is the advice that outlives this single CVE: «consider requiring VPN connections or implementing an additional security layer», because «even exposing the TeamCity login screen or REST API can provide attackers with potential entry points to exploit newly disclosed vulnerabilities». A build server almost never needs to be reachable by the entire world.
Reduce the process privileges. The damage from this flaw is bounded by the permissions the server runs with: «run the TeamCity server with the minimum operating system privileges required for normal operation». JetBrains also recommends keeping the server on dedicated hosts, separate from build agents.
If you were exposed, updating does not close the investigation. With operating system command execution, credentials stored on the server must be treated as potentially read: repository tokens, deployment keys, signing certificates. Rotate them. And it is worth comparing artifacts produced during the suspect window against what was expected — the dullest part of the job, and the only one that answers the question that actually matters, namely whether something left the assembly line that should not have.
What we do not know
It is not public when real exploitation began, nor how many organisations were reached. CISA does not publish the details of the evidence that brings a CVE into KEV, names no actor, and records ransomware campaign use as «Unknown». As of this dossier, no incident response reports from threat intelligence vendors on this specific campaign appear to have been published. The JetBrains Security issues fixed page, cited in the notes of the CISA entry, did not carry a dedicated entry for this CVE at the time of checking: the vendor's primary reference remains the TeamCity blog post.
