CISA Warns of Active JetBrains TeamCity Flaw

JetBrains TeamCity is currently affected by a deserialization of untrusted data vulnerability, tracked as CVE-2026-63077. CISA has confirmed that this flaw is being actively exploited in the wild, leading to its inclusion in the Known Exploited Vulnerabilities catalog as of August 5, 2026.

What's at Risk

The vulnerability impacts the agent polling protocol within TeamCity, potentially allowing unauthenticated remote code execution. Organizations running internet-facing instances of TeamCity are at the highest risk, as these deployments provide a direct pathway for unauthorized actors to interact with the agent polling mechanism.

Because TeamCity is often integrated into critical software development pipelines, a compromise of the server can have cascading effects on an organization's entire build and deployment infrastructure. Security teams should prioritize identifying all internal and external instances of the software to assess their exposure levels.

How the Flaw Works

The vulnerability is categorized under CWE-502, which refers to the deserialization of untrusted data. In general terms, this class of weakness occurs when an application takes data from an untrusted source and uses it to reconstruct an object without sufficient validation. If the application environment is not properly secured, an attacker can craft malicious serialized objects that, when deserialized, execute arbitrary code on the host system.

This type of flaw effectively bypasses standard authentication controls because the malicious payload is processed during the deserialization phase. Once the code executes, the attacker may gain the same level of system access as the application service itself, providing a platform for further network intrusion or data theft.

How to Protect Your Systems

• Apply all available mitigations and security patches provided by JetBrains immediately.
• Ensure full compliance with CISA’s BOD 26-04 requirements, including the mandatory remediation deadline of August 8, 2026.
• Follow CISA’s guidance on Forensics Triage Requirements to identify any potential indicators of compromise on existing systems.
• Restrict network access to TeamCity management interfaces, ensuring they are not exposed to the public internet unless absolutely necessary.
• Segment internal build networks to limit the potential blast radius if a TeamCity agent or server is successfully compromised.
• Monitor server logs for unusual polling activity or unexpected process execution patterns that deviate from standard build operations.

The active exploitation of CVE-2026-63077 underscores the necessity of rapid response for critical vulnerabilities. Given the short window provided for federal remediation, organizations should treat this as a high-priority task. Delaying updates on internet-exposed infrastructure significantly increases the likelihood of a successful breach, especially when threat actors are known to be actively targeting the flaw.