Attackers are exploiting the critical JetBrains TeamCity flaw that was patched at the end of July. The US Cybersecurity and Infrastructure Security Agency added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on August 5, a list the agency only adds to when it has evidence of active exploitation.
That reverses the picture at disclosure. When IntelFusions covered the original advisory in late July, JetBrains said it was not aware of any exploitation. A week later, the US government's list of the bugs attackers are actually using says otherwise.
What's affected
TeamCity is the build server many software teams run on their own infrastructure to compile, test and ship code. CVE-2026-63077 is a deserialization of untrusted data flaw, which means the server takes data off the network and rebuilds it into live objects before checking whether it should. It sits in the agent polling protocol, the channel build agents use to ask the server for work, and it can be reached by someone who has never logged in. It carries a CVSS score of 9.8 out of 10.
The NVD entry lists TeamCity On-Premises releases before 2026.1.3 and 2025.11.7 as affected. TeamCity Cloud customers do not need to act.
What CISA published, and what it did not
CISA's August 5 alert is deliberately spare: one CVE, its vulnerability class, and the standing directive language. The agency named no threat actor, no campaign and no victim, gave no indication of how widespread the attacks are, and did not flag the flaw as being used in ransomware operations. The KEV listing carries the fact of exploitation and nothing more; JetBrains' own advisory is where the technical detail lives.
Under Binding Operational Directive 26-04, federal civilian agencies have to prioritize rapid remediation of KEV-listed flaws on publicly exposed assets where exploitation grants total control of the asset, and have to check whether attackers had already compromised a system before the patch went on. CISA encourages every other organization to work the same way.
What you should do
Update TeamCity On-Premises to 2026.1.3 or 2025.11.7. JetBrains also publishes a security patch plugin for older installations that addresses this issue on its own, which is a stopgap rather than a substitute for upgrading.
If the server was reachable from the internet while unpatched, patching is only half the job. A KEV listing is the point at which "vulnerable" turns into "assume someone tried". Review build agent connections and build configurations for anything nobody remembers adding, look for outbound connections the server should not be making, and rotate what it holds: cloud keys, code signing material, package registry tokens and repository credentials. An attacker who runs code on a build server takes the pipeline, not just the box, which is the lesson of the GitHub Actions flaw abused to plant npm backdoors.
Build systems rarely need to face the open internet. Putting TeamCity behind a VPN or an access proxy removes most of the exposure on its own.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.