Executive Summary
In July 2026, JetBrains identified a critical vulnerability (CVE-2026-63077) in TeamCity On-Premises, allowing unauthenticated remote code execution via the agent polling protocol. This flaw enables attackers to bypass authentication and execute arbitrary OS commands with the server's privileges, potentially exposing sensitive data and compromising CI/CD pipelines. JetBrains released patches in versions 2025.11.7 and 2026.1.3 to address this issue. (blog.jetbrains.com)
By August 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported active exploitation of this vulnerability in the wild, emphasizing the urgency for organizations to apply the available patches promptly to mitigate potential threats.
Why This Matters Now
The active exploitation of CVE-2026-63077 poses an immediate risk to organizations using unpatched TeamCity On-Premises servers. Prompt application of the provided patches is crucial to prevent unauthorized access and potential compromise of sensitive data and build environments.
Attack Path Analysis
An unauthenticated attacker exploited a deserialization vulnerability in JetBrains TeamCity's agent polling protocol to execute arbitrary commands on the server. This allowed the attacker to gain elevated privileges, access sensitive data, and potentially compromise build artifacts. The attacker established command and control channels to maintain access and exfiltrated sensitive information. The attack culminated in the potential disruption of CI/CD pipelines and compromise of downstream systems.
Kill Chain Progression
Initial Compromise
Description
An unauthenticated attacker exploited a deserialization vulnerability in JetBrains TeamCity's agent polling protocol to execute arbitrary commands on the server.
Related CVEs
CVE-2026-63077
CVSS 9.8A critical vulnerability in JetBrains TeamCity On-Premises allows unauthenticated remote code execution via the agent polling protocol.
Affected Products:
JetBrains TeamCity On-Premises – < 2025.11.7, < 2026.1.3
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: Windows Command Shell
Command and Scripting Interpreter: Unix Shell
Exploitation for Client Execution
Valid Accounts
Account Discovery
Credentials from Password Stores
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches.
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Asset Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical exposure through TeamCity CI/CD infrastructure enables unauthenticated remote code execution, compromising build artifacts, source code, and development pipeline integrity.
Information Technology/IT
High risk from CVE-2026-63077 exploitation targeting TeamCity servers, enabling lateral movement, credential theft, and compromise of client infrastructure management systems.
Financial Services
Severe compliance violations and data exposure risks through compromised CI/CD pipelines, threatening financial application security and regulatory adherence under active exploitation.
Government Administration
Federal agencies face mandatory patching deadline by August 8, 2026 under BOD 26-04, with critical national security implications from TeamCity infrastructure compromise.
Sources
- CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wildhttps://thehackernews.com/2026/08/cisa-flags-teamcity-cve-2026-63077-rce.htmlVerified
- Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077) – Update to 2025.11.7 or 2026.1.3 Nowhttps://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/Verified
- CISA Adds One Known Exploited Vulnerability to Cataloghttps://www.cisa.gov/news-events/alerts/2026/08/05/cisa-adds-one-known-exploited-vulnerability-catalogVerified
- Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging Inhttps://thehackernews.com/2026/07/critical-teamcity-flaw-could-let.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to move laterally, escalate privileges, and exfiltrate data by enforcing strict segmentation and identity-based access controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's initial access would likely be constrained, reducing the ability to execute arbitrary commands on the server.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges would likely be limited, reducing the scope of unauthorized access within the server environment.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement would likely be constrained, reducing the ability to access other systems connected to the TeamCity server.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels would likely be limited, reducing persistent access to compromised systems.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's data exfiltration efforts would likely be constrained, reducing the ability to transfer sensitive data out of the compromised systems.
The potential disruption of CI/CD pipelines and compromise of downstream systems would likely be reduced, limiting the overall impact of the attack.
Impact at a Glance
Affected Business Functions
- Continuous Integration/Continuous Deployment (CI/CD) Pipelines
- Software Development
- Build Management
Estimated downtime: 7 days
Estimated loss: $500,000
Source code repositories, build configurations, stored credentials
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict unauthorized lateral movement within the network.
- • Deploy Inline IPS (Suricata) to detect and prevent exploitation attempts targeting known vulnerabilities.
- • Utilize Cloud Firewall (ACF) to enforce egress security policies and monitor outbound traffic for anomalies.
- • Enhance Threat Detection & Anomaly Response capabilities to identify and respond to suspicious activities promptly.
- • Regularly update and patch systems to mitigate known vulnerabilities and reduce the attack surface.
