JetBrains patched a critical flaw in TeamCity On-Premises in late July, and CISA has now confirmed it is under active exploitation in the wild. CVE-2026-63077 sits in TeamCity's agent polling protocol: an attacker with nothing more than network access to the server — no login, no credentials — can send a crafted payload that triggers deserialization of untrusted data, letting them run arbitrary operating-system commands with the same privileges as the TeamCity server process itself. CISA rates it 9.8 out of 10 and added it to its Known Exploited Vulnerabilities catalog on 5 August, giving US federal agencies an unusually tight window: mitigations were due today, 8 August.
The affected range is every TeamCity On-Premises release before 2025.11.7 and before 2026.1.3 — in practice, most self-hosted installs that haven't updated since the patch shipped. JetBrains has also released a standalone security patch plugin covering older branches back to 2017.1, for teams that can't do a full version upgrade on short notice. What makes this one worth moving on quickly, rather than filing it under "patch eventually", is what TeamCity actually is: a build server that holds source code, build credentials, and often a direct path to production deploys. An attacker who gets code execution on the box isn't just breaching one server — they're standing inside the software supply chain, with the ability to tamper with builds before they ever reach a client or an app store.
What this means for your business
If your team or a client runs a self-hosted TeamCity server — not JetBrains' cloud offering, but the on-premises kind agencies and dev shops typically stand up for their own CI/CD — check the version today, not on the next maintenance window. Anything older than 2025.11.7 or 2026.1.3 needs the update, or at minimum the security patch plugin if a full upgrade isn't feasible right now. If the server is reachable from the open internet rather than sitting behind a VPN or IP allowlist, treat that as the more urgent half of the fix: restricting network access buys time even before the patch lands. And because this is a build server, don't stop at patching — if there's any reason to suspect the box was already exposed, it's worth reviewing recent build artifacts and deploy credentials for signs of tampering, not just closing the hole after the fact.