Critical Vulnerability in TeamCity Servers: CVE-2026-63077 Under Active Exploitation
JetBrains confirms active attacks targeting unpatched TeamCity instances via agent protocol flaw.
1Urgency of the Vulnerability
JetBrains has confirmed active exploitation of CVE-2026-63077, disclosed on July 27, 2026. Unpatched TeamCity servers prior to version 2025.11.7 are vulnerable to remote code execution without authentication. The company mandates immediate upgrades to 2026.1.3 or installation of a security plugin. TeamCity Cloud users require no additional action as mitigations are already implemented on the platform.
2Technical Attack Vector
The vulnerability stems from a flaw in TeamCity's agent polling protocol. Attackers with HTTPS access can execute OS commands with server process privileges. This enables access to configuration files, credential theft, and manipulation of CI/CD pipelines. Internet-exposed servers face particularly high risk, with potential for complete system compromise and supply chain attacks.
3Patch and Workarounds
JetBrains released a security plugin for versions 2017.1 and later, though it only addresses CVE-2026-63077. Full version upgrades are recommended for comprehensive protection. Temporary measures include restricting external access, enforcing VPN connections, and running TeamCity with least privilege. The company emphasizes these should not replace permanent patching.
4Forensic Indicators
Administrators should monitor logs for 'com.thoughtworks.xstream.converters.ConversionException' errors, which may indicate exploit attempts. On patched systems, 'com.thoughtworks.xstream.security.ForbiddenClassException' messages confirm blocked attacks. Unauthorized build agents with 'scan' prefixes also warrant investigation, as they may signal reconnaissance activity.
5Potential Impact Scope
Compromised systems risk source code theft, software distribution channel takeover, and lateral movement to connected systems. The vulnerability poses particular threats to financial and healthcare organizations. A similar 2022 vulnerability led to data breaches in 17% of Fortune 500 companies, demonstrating the potential scale of impact.
6Industry-Wide Implications
TeamCity is widely adopted among enterprise software teams, with over 60,000 organizations including Microsoft and Amazon relying on it. Unmitigated vulnerabilities could create cascading effects across software supply chains. Security analysts consider this the most severe CI/CD threat since the Log4j crisis, given TeamCity's central role in build processes.
7Long-Term Mitigations
JetBrains recommends restricting server access to trusted networks and running build agents on separate hosts. Enterprise users should implement SIEM integration and anomalous activity monitoring. Regular security audits and penetration testing can help detect similar vulnerabilities earlier, reducing exposure windows for critical systems.
8Critical Response Window
Cybersecurity experts note that the first 72 hours after vulnerability disclosure typically see peak exploitation attempts. Given TeamCity's central role in CI/CD ecosystems, patching urgency is heightened. A comparable 2025 vulnerability saw average 14-day patch delays, during which 4,200 servers were compromised, underscoring the importance of rapid response.