Critical TeamCity RCE Flaw Actively Exploited — Patch Immediately
A critical unauthenticated remote code execution vulnerability (CVE-2026-63077, CVSS 9.8) in JetBrains TeamCity on-premise installations is being actively exploited in the wild, allowing attackers to bypass security controls and execute arbitrary commands without any credentials. This type of flaw is particularly dangerous because it requires no user interaction or authentication, meaning any internet-exposed instance is immediately at risk. CI/CD platforms like TeamCity are high-value targets since they sit at the heart of software build pipelines and can be leveraged to inject malicious code into downstream software. CISA's inclusion in the Known Exploited Vulnerabilities (KEV) catalog confirms real-world abuse is underway, making delayed patching an unacceptable risk. Organizations running on-premise versions must treat this as a critical incident requiring emergency response, not routine maintenance.
Tactical Insight
Immediate Actions
- Apply the vendor-supplied patch or upgrade TeamCity to the latest fixed version before the August 8, 2026 federal deadline.
- Immediately restrict public internet access to all on-premise TeamCity instances behind a VPN or firewall while patching is underway.
- Audit TeamCity server logs for indicators of compromise such as unexpected process spawning, unusual API calls, or unauthorized user creation.
Long-term Improvements
- Maintain a continuously updated inventory of all internet-facing applications and their versions to enable rapid identification of vulnerable assets.
- Implement an emergency patching SLA (e.g., 24–72 hours) specifically for CVSS 9.0+ vulnerabilities or CISA KEV-listed flaws.
- Enforce network segmentation to isolate CI/CD infrastructure from production environments and limit lateral movement in the event of compromise.
Detection Measures
- Deploy a Web Application Firewall (WAF) or intrusion detection system tuned to detect exploitation attempts targeting TeamCity endpoints.
- Enable centralized logging and alerting for all authentication events and administrative actions within TeamCity.
- Subscribe to vendor security advisories and CISA KEV feed alerts to ensure zero delay in awareness of newly disclosed critical vulnerabilities.