CISA ADDS ACTIVELY EXPLOITED JETBRAINS TEAMCITY DESERIALIZATION VULNERABILITY TO KNOWN EXPLOITED VULNERABILITIES CATALOG

THREAT SUMMARY

Category: Active Exploitation / Software Development Security / Deserialization of Untrusted Data / Build-System Compromise
Affected Product: JetBrains TeamCity
CVE: CVE-2026-63077
Primary Risks: Unauthorized Code Execution, TeamCity Server Compromise, Credential Exposure, Source-Code Theft, Build-Pipeline Manipulation, Malicious Software Distribution, Persistent Access and Lateral Movement
Threat Status: Confirmed Active Exploitation
Affected Environment: Federal Agencies, Software Developers, Technology Companies, Managed Service Providers, Critical Infrastructure and Organizations Operating JetBrains TeamCity
Attack Vector: Deserialization of Untrusted Data
CISA Action: Added to Known Exploited Vulnerabilities Catalog
Required Response: Identify affected deployments, apply available remediation, restrict unnecessary exposure and inspect systems for evidence of compromise

---

The Cybersecurity and Infrastructure Security Agency has added CVE-2026-63077, a deserialization-of-untrusted-data vulnerability affecting JetBrains TeamCity, to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation.

CISA announced the addition on August 5, 2026, warning that this class of vulnerability is frequently used by malicious cyber actors and poses significant risks to the federal enterprise.

The KEV designation confirms that CISA has evidence of active exploitation involving CVE-2026-63077. CISA has not identified the responsible threat actors, named affected organizations or disclosed the scale of the exploitation activity in its alert.

JetBrains TeamCity is a continuous-integration and continuous-delivery platform used to automate software compilation, testing, packaging and deployment. TeamCity servers can occupy trusted positions inside development environments and may hold access to source-code repositories, build agents, software artifacts, deployment systems, signing infrastructure and cloud services.

That position can make a compromised TeamCity environment valuable to attackers. Access to a build platform may provide opportunities to steal proprietary code, obtain credentials, manipulate software-development processes or distribute malicious changes through trusted deployment channels.

CVE-2026-63077 involves the deserialization of untrusted data. Deserialization occurs when an application converts stored or transmitted data back into an object or structure that the software can process.

If an application accepts serialized information from an untrusted source without sufficient validation, an attacker may be able to construct malicious data that causes the application to perform unintended actions. Depending on the vulnerable component and the privileges assigned to the affected service, successful exploitation could lead to unauthorized command execution or broader control of the TeamCity server.

A TeamCity server accessible from the public internet presents the most immediate concern. Internal deployments can also remain at risk if attackers gain access through stolen credentials, compromised remote-access services, infected endpoints or another breached system inside the network.

Build systems commonly store or process sensitive authentication material needed to retrieve source code, access development services and deploy finished software. This material may include access tokens, repository credentials, application programming interface keys, cloud credentials, certificates and secrets used by automated build processes.

The consequences of exploitation will depend on the affected TeamCity configuration, the permissions assigned to the server and build agents, the accessibility of connected repositories and the level of trust placed in generated software artifacts.

---

Operational Impact

Organizations operating affected TeamCity systems could face:

• Unauthorized access to TeamCity servers
• Execution of attacker-controlled commands
• Compromise of build agents
• Theft of source code and proprietary development information
• Exposure of repository credentials and access tokens
• Theft of cloud credentials, signing keys and deployment secrets
• Unauthorized modification of software projects
• Manipulation of build configurations and automation scripts
• Insertion of malicious code into legitimate software
• Creation of unauthorized administrator accounts
• Deployment of malware through trusted development channels
• Compromise of connected repositories and development platforms
• Movement into production, testing or cloud environments
• Persistent access through altered build processes or credentials
• Loss of software integrity
• Interruption of development and deployment operations
• Destruction or alteration of build artifacts
• Reduced confidence in previously generated software packages
• Compromise of downstream customers or connected organizations
• Broader software supply-chain exposure

A compromised build server can create risks extending beyond the original TeamCity deployment. Software created or distributed through an affected environment may require additional examination to determine whether attackers altered build instructions, inserted unauthorized components or replaced legitimate artifacts.

---

Federal Response

CISA added CVE-2026-63077 to the Known Exploited Vulnerabilities Catalog under Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk.

BOD 26-04 establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies and directs them to prioritize rapid remediation of high-risk KEV vulnerabilities.

The directive places particular emphasis on KEV-listed vulnerabilities affecting publicly exposed assets when successful exploitation can provide total control of the affected system. It also establishes expectations for determining whether malicious actors compromised a system before security updates or mitigations were applied.

Federal agencies operating JetBrains TeamCity must identify affected deployments, determine whether the systems are publicly exposed, evaluate the level of access they provide and complete the remediation required by CISA.

Agencies may also need to conduct compromise assessments rather than treating installation of a security update as the complete response. Patching can close a vulnerability, but it cannot remove accounts, credentials, malicious files, altered build configurations or other persistence established before remediation.

BOD 26-04 applies directly to Federal Civilian Executive Branch agencies. CISA encourages private companies, critical infrastructure operators, software developers, educational institutions, healthcare organizations, financial institutions, state and local governments and technology providers to use the KEV Catalog when prioritizing vulnerability remediation.

---

KEV Catalog Requirements

CISA adds vulnerabilities to the Known Exploited Vulnerabilities Catalog when they meet the agency’s established criteria.

A vulnerability considered for inclusion must have an assigned Common Vulnerabilities and Exposures identifier, reliable evidence that malicious actors have exploited it and clear mitigation guidance.

The catalog helps organizations distinguish vulnerabilities under active exploitation from the much larger number of publicly disclosed weaknesses that may not present the same immediate operational threat.

Placement in the KEV Catalog does not identify the number of affected systems or determine whether every exposed deployment has already been attacked. It confirms that exploitation has occurred and that vulnerable organizations should prioritize action.

---

Defensive Guidance

Organizations operating JetBrains TeamCity should:

• Identify every TeamCity server and build agent within the organization.
• Document the installed versions, system configurations and network locations.
• Determine which TeamCity services are accessible from the internet or other untrusted networks.
• Apply available JetBrains security updates or required mitigations.
• Prioritize remediation according to CISA KEV requirements.
• Remove unnecessary public access to TeamCity administrative interfaces.
• Restrict administrative access to trusted networks and authorized personnel.
• Place externally accessible management services behind properly secured access controls.
• Preserve TeamCity, operating-system, authentication and network records before making major changes.
• Review historical activity for evidence of exploitation before remediation.
• Examine administrative records for unfamiliar accounts, sessions and privilege changes.
• Search for unexpected modifications to build configurations, projects and automation scripts.
• Inspect build agents for unauthorized files, processes, services and scheduled tasks.
• Review source-code repositories for unexplained commits, branches and access activity.
• Examine generated software artifacts for unauthorized changes.
• Compare recent builds with trusted source code and reproducible build records when available.
• Audit credentials, tokens, certificates, signing keys and secrets accessible to TeamCity.
• Revoke or rotate authentication material that may have been exposed.
• Terminate unauthorized or unexplained active sessions.
• Review connections between TeamCity and cloud, deployment and repository services.
• Search connected systems for evidence of lateral movement.
• Isolate affected servers when immediate remediation cannot be completed.
• Confirm remediation across production, development, testing, backup and recovery environments.
• Investigate software produced by a confirmed compromised server before allowing further distribution.
• Preserve relevant evidence for forensic examination.
• Continue monitoring after remediation for persistent or delayed attacker activity.
• Discontinue use of affected systems if effective mitigation is unavailable.

Organizations should avoid assuming that a successful update proves the environment was not previously compromised. Security teams must determine whether attackers accessed the server before remediation and whether they used that access to obtain credentials or manipulate software-development processes.

---

Forecast — 30 Days

• Accelerated scanning for internet-accessible JetBrains TeamCity deployments
• Continued exploitation of systems that remain unpatched or improperly mitigated
• Increased targeting of software-development and continuous-integration infrastructure
• Expanded attempts to steal repository credentials, access tokens and deployment secrets
• Greater scrutiny of TeamCity administrative and build activity for evidence of prior exploitation
• Increased credential rotation across affected development environments
• Attempts to compromise connected build agents, repositories and deployment systems
• Possible use of compromised build infrastructure to distribute malicious software
• Publication of additional technical details and defensive guidance concerning CVE-2026-63077
• Possible release of indicators of compromise as investigations develop
• Increased incorporation of the vulnerability into automated exploitation activity
• Accelerated remediation across federal agencies, technology companies and critical infrastructure
• Additional compromise assessments involving previously exposed TeamCity servers

---

TRJ Verdict

CISA’s addition of CVE-2026-63077 confirms that malicious cyber actors are actively exploiting a vulnerability affecting infrastructure responsible for building, testing and deploying software.

A compromised TeamCity server can create consequences extending far beyond a single host. Attackers may gain access to source code, development credentials, deployment systems and trusted software-distribution processes.

Organizations should treat this KEV addition as an immediate security event. Applying available remediation is necessary, but systems exposed before remediation must also be examined for unauthorized accounts, altered build configurations, stolen credentials, malicious artifacts and access to connected environments.

The central risk is not limited to the TeamCity server. Any software created or distributed through a confirmed compromised environment may require validation before it can be trusted.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---