Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Exploited vulnerability
TeamCity agent protocol flaw (CVE-2026-63077)
CVE-2026-63077
CVE-2026-63077 is a flaw in JetBrains TeamCity On-Premises, a server that builds and ships software (a CI/CD tool).
- On CISA KEV
- CVE ID
- CVE-2026-63077
- CISA KEV
- Listed
- Affected product
- TeamCity On-Premises
- Exploited
- Yes
- Published
- July 2026
In short
CVE-2026-63077 is a flaw in JetBrains TeamCity On-Premises, a server that builds and ships software (a CI/CD tool). An outsider can send crafted data to the server and run commands on it. CISA lists it as exploited and flags known ransomware campaign use.
- CVECVE-2026-63077
- ProductJetBrains TeamCity On-Premises
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpgrade now · Cut exposure
What it allows
An unauthenticated attacker with HTTP or HTTPS access to a TeamCity server can bypass authentication checks and run operating system commands with the rights of the server process. The vendor says this could expose TeamCity data, configurations and stored credentials, change server state and may compromise build artifacts and downstream CI/CD pipelines. That makes it a supply chain risk, not only a server risk. NVD lists CVSS v3.1 9.8 (Critical), taken from the JetBrains record.
Who is affected
The vendor says all TeamCity On-Premises versions were affected when it announced the issue. The fixes are in 2025.11.7 and 2026.1.3. The NVD record lists versions before 2025.11.7, and 2026.1 up to before 2026.1.3. TeamCity Cloud customers need to take no action, per the vendor. For servers that cannot be upgraded, JetBrains released a security patch plugin for TeamCity 2017.1 and later. The plugin fixes only this flaw.
The vendor says the flaw was reported to it privately on 10 July 2026 and announced fixes on 27 July 2026. NVD published the record the same day. At that time the vendor said it knew of no active exploitation.
CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog on 5 August 2026, with a due date of 8 August 2026. The KEV entry flags known use in ransomware campaigns. In a follow-up post, the vendor said it had received reports of active exploitation and attempted exploitation of unpatched servers since 27 July 2026. The sources opened here do not name an actor, so none is attributed.
What to do
-
Upgrade now
Install 2025.11.7 or 2026.1.3. TeamCity 2024.03 and newer can download security patch plugins and notify administrators under Administration, Updates.
-
Use the patch plugin if you cannot upgrade
Install the vendor's security patch plugin. Versions 2017.1 to 2018.1 need a server restart. It covers only this flaw, so still plan an upgrade.
-
Cut exposure
If the server is on the internet and you cannot patch at once, restrict external access until you do. Keep TeamCity on trusted networks or behind a VPN, run it with minimum operating system rights, and keep it on a host separate from build agents.
-
Detect and hunt
Per the vendor, search server logs for com.thoughtworks.xstream.converters.ConversionException, which may mean an attempted or successful exploit. On patched servers, com.thoughtworks.xstream.security.ForbiddenClassException means an attempt was blocked. Check the unauthorized agents list for names starting with scan. If a server was exposed unpatched, rotate stored credentials and review build artifacts.
Questions
What is CVE-2026-63077?
It is a deserialization flaw (CWE-502) in the agent polling protocol of JetBrains TeamCity On-Premises. An unauthenticated attacker with HTTP or HTTPS access can bypass authentication checks and run operating system commands. NVD lists CVSS 9.8.
Which TeamCity versions fix CVE-2026-63077?
The fixes are in TeamCity 2025.11.7 and 2026.1.3. TeamCity Cloud customers need to take no action, per the vendor. Servers that cannot be upgraded can use the vendor's security patch plugin as a stopgap.
What if I cannot upgrade TeamCity right away?
JetBrains released a security patch plugin for TeamCity 2017.1 and later. It fixes only this flaw, so still plan an upgrade. Until then, restrict external access and keep TeamCity on trusted networks or behind a VPN.
Why is the TeamCity flaw a supply chain risk?
The vendor says an attacker could expose stored credentials and configurations and may compromise build artifacts and downstream CI/CD pipelines. That makes it a supply chain risk, not only a server risk.
Is CVE-2026-63077 exploited in the wild?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 5 August 2026. The vendor said it received reports of active exploitation and attempts against unpatched servers since 27 July 2026.
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.