Loading story…
JetBrains disclosed CVE-2026-63077, a critical remote code execution flaw in TeamCity On-Premises that lets unauthenticated attackers with HTTP(S) access abuse the agent polling protocol to bypass authentication and run arbitrary operating system commands. The vulnerability affects TeamCity versions before 2026.1.3 and 2025.11.7, carries a CVSS 3.1 rating of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and is mapped to CWE-502.
JetBrains released fixes in 2025.11.7 and 2026.1.3, and also published a security patch plugin for TeamCity versions 2017.1 and later for organizations that cannot upgrade immediately. TeamCity Cloud instances were already updated, while JetBrains said it has no evidence of active exploitation; CISA’s SSVC assessment likewise indicates no known exploitation but notes the bug is automatable and could have total technical impact. Successful attacks could expose TeamCity data, configurations, and stored credentials, or allow modification of server state depending on the privileges of the TeamCity process.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of the TeamCity flaw. This represented an escalation from earlier assessments that noted no known exploitation.
JetBrains said the TeamCity RCE vulnerability CVE-2026-63077 was privately reported by Antoni Tremblay. This establishes the initial vendor notification before public disclosure and patch release.
CISA added an SSVC assessment for CVE-2026-63077 indicating no known exploitation, that exploitation would be automatable, and that the technical impact would be total. This added government risk-triage context to the vulnerability record.
JetBrains fixed CVE-2026-63077 in TeamCity versions 2025.11.7 and 2026.1.3. It also released a security patch plugin for TeamCity 2017.1 and later for customers unable to upgrade immediately, while TeamCity Cloud instances were already updated.
JetBrains disclosed a critical unauthenticated remote code execution flaw in TeamCity On-Premises, tracked as CVE-2026-63077, involving the agent polling protocol. The issue affects TeamCity versions before 2025.11.7 and 2026.1.3, and JetBrains said it had no evidence of active exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
23 references tracked. Mallory keeps watching after this page renders.
triskelelabs.com
Open sourceboho.or.kr
Open sourcecybersecuritynews.com
Open sourceinfoworld.com
Open sourcecve.org
Open sourcecvefeed.io
Open sourceblog.jetbrains.com
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **CVE-2026-63077** to its Known Exploited Vulnerabilities catalog after attackers began exploiting a critical JetBrains TeamCity On-Premises flaw that enables **unauthenticated remote code execution**. The vulnerability stems from deserialization of untrusted data in the TeamCity agent polling protocol and can be triggered over HTTP or HTTPS, allowing attackers to bypass authentication and execute operating system commands on exposed servers. JetBrains said all TeamCity On-Premises versions were affected until fixes shipped in **2025.11.7** and **2026.1.3**, and also released a security patch plugin for versions **2017.1 and later** as a temporary mitigation path. Under **BOD 26-04**, CISA ordered federal civilian agencies to remediate by **2026-08-08**. A successful compromise of TeamCity can expose source code, secrets, signing material, and deployment connections, raising the risk of broader software supply-chain compromise.
Aug 7, 2026
JetBrains has patched a high-severity vulnerability in TeamCity On-Premises, tracked as **`CVE-2026-44413`**, that can allow privilege escalation and expose parts of the TeamCity server API to unauthorized users. The company said affected deployments include TeamCity On-Premises **2025.11.4 and earlier**, and advised customers to upgrade to **TeamCity 2026.1** or apply the available security patch plugin. According to JetBrains, the flaw could expose sensitive data including API tokens, Git credentials, build secrets, logs, and user information, with higher risk in environments that permit inbound connections on non-standard ports or run build agents on the same host as the TeamCity server. The issue requires access to a TeamCity account, which attackers could obtain through brute force, credential stuffing, leaked credentials, social engineering, or enabled guest access, raising the prospect of follow-on compromise of cloud infrastructure, source code repositories, and software delivery pipelines. The disclosure comes against a backdrop of repeated TeamCity security incidents, including **`CVE-2024-27198`** and **`CVE-2024-27199`**, two critical flaws that allowed unauthenticated attackers to bypass authentication, take over servers, alter certificates and ports, and create supply-chain attack paths; those earlier bugs were fixed in **2023.11.4** after researchers warned they could lead to full server compromise.
Jun 29, 2026
Attackers exploited **CVE-2026-63077**, a critical (CVSS 9.8) authentication-bypass and arbitrary-command-execution flaw affecting all JetBrains TeamCity On-Premises versions, to compromise an unpatched TeamCity server supporting JetBrains’ Cadence cloud development service. Activity at `api.cadence.jetbrains.com` ran from August 8 to August 24 and may have exposed a 2024 server backup, user data, source code, credentials, configurations, build artifacts, and logs. JetBrains confirmed compromise of several AWS IAM users and access to files in its AWS S3 buckets, while it continued investigating whether customer storage buckets were accessed. Australian authorities and CISA had already warned of active exploitation and urged organizations to identify exposed TeamCity instances, apply JetBrains updates or its security patch plugin, and remove TeamCity interfaces from direct internet exposure where possible. Public exploit support has also advanced through Metasploit module `exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077`, including improved payload selection for Java/JSP, Windows, and Linux targets. Cadence users should rotate every credential and secret handled by the service, investigate connected environments for unauthorized activity and lateral movement, and treat executions and outputs generated during the exposure period as untrusted.
Aug 28, 2026