The Cybersecurity and Infrastructure Security Agency (CISA) added a critical unauthenticated remote code execution flaw in JetBrains' TeamCity On-Premises to its Known Exploited Vulnerabilities (KEV) catalog This article explores attacker access teamcity. . The agency's exploitation assessment moved from "none" to "active," and it now rates the flaw as both automatable and capable of total technical impact.
This deserialization vulnerability, CVE-2026-63077, resides in TeamCity’s agent polling protocol, which agents use to check for job assignments via the channel distributed build agents connect to the central server. An attacker who has access to a TeamCity server through HTTP or HTTPS can bypass authentication checks entirely and execute arbitrary operating system commands with the privileges of the TeamCity server process.
TeamCity Servers Exploited An attacker who has access to a TeamCity server through HTTP or HTTPS can bypass authentication checks entirely and execute arbitrary operating system commands with the privileges of the TeamCity server process. Organizations that can't upgrade right away should deploy the interim security patch plugin, which covers TeamCity versions 2017.1 and later; servers running versions 2017.1 through 2018.1 must restart after applying the patch, while 2018.2 and later can apply it without a reboot. Enhance threat detection and response times by leveraging browser-based data inspection capabilities from ANY.RUN.
