The U.S This article explores vulnerabilities teamcity. . Cybersecurity and Infrastructure Security Agency has issued a warning about a critical vulnerability in JetBrains' TeamCity, which can be exploited by an unauthenticated attacker on vulnerable On-Premises servers.
The flaw, identified as CVE-2026-63077, was added to the agency's Known Exploited Vulnerabilities catalog on August 5 and requires federal civilian agencies to remediate their systems by August 8. A compromise of its central server can introduce significant supply-chain risks. Attackers may gain access to source code, build settings, stored secrets, signing material, and deployment connections. A remote attacker with HTTP or HTTPS access has exploited a vulnerability in TeamCity, allowing them to bypass authentication checks and execute operating system commands as the TeamCity server process.
The company released patched versions 2025.11.7 and 2026.1.3, enabling organizations unable to upgrade immediately to use JetBrains' security patch plugin on TeamCity 2017.1 and later. Threat actors frequently exploit vulnerabilities in TeamCity on-premises installations to gain initial access, steal credentials, and move laterally within enterprise environments. Additionally, they should review server and web logs for unusual agent polling activity, unexpected administrator actions, unfamiliar plugins, new accounts, and suspicious command execution.
CISA also recommends assessing each asset's internet exposure and following risk-based patching and forensic triage requirements. Prompt remediation is crucial: unauthenticated remote code execution on a build server can rapidly escalate into a full software supply chain incident.
