A Critical Vulnerability in TeamCity is Being Actively Exploited, Warns CISA
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about an actively exploited vulnerability in JetBrains’ TeamCity software. The flaw, identified as CVE-2026-63077, allows attackers to execute arbitrary code on vulnerable systems, giving them unrestricted access to sensitive data and potentially enabling lateral movement within networks.
TeamCity is a widely used continuous integration and continuous deployment (CI/CD) tool that helps developers automate the build, test, and deployment process. It’s often integrated into development environments and can be accessed by multiple users with varying levels of permissions. The vulnerability affects TeamCity versions 2022.1.3 and earlier, putting thousands of organizations at risk.
The flaw is a remote code execution (RCE) bug that stems from an insecure deserialization mechanism in the TeamCity service. When an attacker sends malicious data to the service, it can lead to unauthorized code execution on the server-side. This enables the attacker to escalate privileges and potentially gain control over the entire system. CISA notes that the vulnerability is being actively exploited in the wild, meaning attackers are already using it to compromise systems.
The scope of the vulnerability is significant, as TeamCity is a popular choice among development teams across various industries, including finance, healthcare, and government. Organizations that rely on TeamCity for their CI/CD pipeline should take immediate action to mitigate the risk. This includes applying security patches, reviewing access controls, and monitoring system logs for suspicious activity.
While the vulnerability is serious, it’s worth noting that JetBrains has already released a patch to address CVE-2026-63077 in newer versions of TeamCity. However, many organizations may not be aware of this or may have older versions installed on their systems. This highlights the importance of regular security updates and the need for developers to stay informed about vulnerabilities affecting their tools.
Ultimately, the active exploitation of this vulnerability serves as a reminder that even widely used software can harbor significant security risks. To protect against similar threats in the future, it’s essential for organizations to prioritize security awareness, implement robust patch management practices, and regularly review their system configurations for potential weaknesses.
Source: The Hacker News — 2026-08-06