The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-63077, a critical Remote Code Execution (RCE) vulnerability affecting JetBrains TeamCity, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild.
The flaw allows attackers to execute arbitrary code on vulnerable TeamCity servers, potentially leading to complete system compromise, unauthorized access, credential theft, and lateral movement within enterprise networks. Since TeamCity is widely used for CI/CD pipelines and software development automation, a successful attack could expose source code, build environments, and sensitive development assets.
CISA is urging organizations to immediately apply the latest security patches, review TeamCity servers for indicators of compromise (IoCs), restrict internet exposure where possible, and strengthen access controls. Organizations should also enable Multi-Factor Authentication (MFA), monitor server logs for suspicious activity, and ensure development infrastructure follows the principle of least privilege.
Why It Matters
CI/CD platforms are high-value targets because they provide attackers with direct access to software development environments. Compromising a build server can enable supply chain attacks, source code theft, and the distribution of malicious software through trusted pipelines.
Conclusion
The active exploitation of CVE-2026-63077 highlights the urgent need for organizations using TeamCity to patch vulnerable systems without delay. Prompt remediation, continuous monitoring, and strong security controls are essential to protecting software development infrastructure from evolving cyber threats.
