Reported by 11 outlets
TeamCity RCE Exploit Window Closes Today — Rapid7 Details Permissive XStream Allowlist
Why this score
- Breadth
- 2.00 / 2.0 · 11 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.22 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-63077 is an unauthenticated deserialization flaw, CWE-502, scored 9.8, in JetBrains TeamCity On-Premises. Rapid7's analysis shows the vulnerable server builds a permissively scoped XStream allowlist, so an attacker with HTTP(S) reachability can ride the agent polling protocol past authentication and execute operating system commands with the privileges of the TeamCity server process. Every On-Premises version is affected; fixes shipped in 2025.11.7 and 2026.1.3. Antoni Tremblay reported the bug privately on July 10, JetBrains published the advisory July 27, CISA added the flaw to KEV on August 5 with an August 8 BOD deadline, JetBrains confirmed in-the-wild exploitation and published indicators on August 7, and in September CISA warned that ransomware gangs had joined the exploitation in targeted attacks.
The newest development is CISA confirming the flaw is driving real extortion operations, with relayed reporting putting the count of still-exposed installations at roughly 160. That number is the whole story of this vulnerability's lifecycle: a fix available since July 27, a federal deadline in early August, published indicators since August 7, and months later a residual population large enough to sustain extortion campaigns. A compromised TeamCity server exposes stored credentials, build configurations, and artifacts, converting one RCE into a supply-chain problem for everything the pipeline builds.
Any instance not yet on 2025.11.7, 2026.1.3, or the security patch plugin (which installs on 2017.1 and later) should be treated as compromised: run JetBrains' indicator set, audit for unauthorized agent registrations and build-config changes, rotate credentials held in TeamCity, and restrict access to trusted networks or VPN. Watch for CISA naming specific ransomware families and for a mass-scanning shift now that extortion crews have validated the target list.
Timeline
-
original reporting
TeamCity RCE Exploit Window Closes Today — Rapid7 Details Permissive XStream Allowlist
rapid7.com · 67d ago · August 8th, 2026
Rapid7's technical analysis of CVE-2026-63077, the unauthenticated deserialization RCE in JetBrains TeamCity, shows a vulnerable server builds a permissively scoped XStream allowlist that lets remote attackers execute OS commands via the agent polling protocol. CISA added the flaw to its KEV catalog on August 5 with today's federal remediation deadline. Update to TeamCity 2025.11.7 or 2026.1.3 and treat CI/CD servers as priority assets.
-
update from blog.jetbrains.com
Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077) - Update to 2025.11.7 or 2026.1.3 Now
blog.jetbrains.com · 79d ago · July 27th, 2026
JetBrains' vendor advisory, published July 27, 2026, discloses CVE-2026-63077 as an unauthenticated RCE in TeamCity On-Premises, exploitable over HTTP(S) via the agent polling protocol, affecting all On-Premises versions, with fixes in 2025.11.7 and 2026.1.3 and a security patch plugin for 2017.1+ (auto-downloaded on 2024.03 and newer; restart required only on 2017.1 to 2018.1). It credits researcher Antoni Tremblay with a private report on July 10, 2026, states no exploitation was known at publication, confirms TeamCity Cloud was already fixed and checked with no exploitation found, and advises VPN-only exposure, trusted-network restriction, and running the server process with least privilege on a dedicated host.
-
update from helpnetsecurity.com
JetBrains fixes critical unauthenticated RCE in TeamCity On-Premises (CVE-2026-63077)
helpnetsecurity.com · 78d ago · July 28th, 2026
Early news coverage by Zeljka Zorz, July 28, 2026, one day after the advisory, relaying the fix and plugin guidance and the researcher credit for Antoni Tremblay. It adds the historical context that state-sponsored hacking groups and ransomware affiliates have repeatedly leveraged unpatched TeamCity On-Premises servers, citing CVE-2023-42793 and CVE-2024-27198/CVE-2024-27199.
-
update from thehackernews.com
Critical TeamCity Flaw Could Let Attackers Run OS Commands
thehackernews.com · 78d ago · July 28th, 2026
Coverage dated July 28, 2026 reporting that CVE-2026-63077 could let unauthenticated attackers bypass TeamCity authentication checks and run OS commands, and that JetBrains patched all on-premises versions.
-
update from bleepingcomputer.com
JetBrains TeamCity Critical Auth Bypass (CVE-2026-63077) Allows RCE — All On-Premises Versions Affected
bleepingcomputer.com · 75d ago · July 31st, 2026
JetBrains warned of a critical authentication bypass in TeamCity On-Premises that can be exploited to achieve remote code execution. CVE-2026-63077 lets an attacker with HTTPS access to a TeamCity server bypass authentication via the agent polling protocol and execute arbitrary OS commands with the privileges of the server process — exposing data, configurations, stored credentials, build artifacts, and CI/CD pipelines. - All versions of TeamCity On-Premises affected; TeamCity Cloud already fixed
-
Reported privately July 10; fixed in 2025.11.7 and 2026.1.3, with a patch plugin for 2017.1+ (2024.03+ auto-downloads it)
-
No evidence of active exploitation yet, but TeamCity flaws have been extensively leveraged by ransomware gangs and state-backed actors in the past
-
JetBrains advises VPN-only exposure — even the login page and REST API are entry points
Action: Upgrade immediately or install the patch plugin; audit internet-exposed TeamCity instances and treat unpatched ones as compromised candidates.
-
-
update from securityweek.com
JetBrains TeamCity CVE-2026-63077 Under Active Exploitation — CISA KEV Deadline August 8
securityweek.com · 69d ago · August 6th, 2026
The flaw was added to the Known Exploited Vulnerabilities catalog on August 5 with a BOD 26-04 remediation deadline of August 8 for federal agencies, and SecurityWeek reports hackers have begun exploiting it. A compromised CI/CD server means source-code theft, stored credentials, and malicious code shipped in software releases — treat any unpatched, internet-reachable instance as compromised and audit for unauthorized agents and build-config changes.
-
update from bleepingcomputer.com
CISA: Ransomware gangs now exploiting critical TeamCity flaw
bleepingcomputer.com · 19d ago · September 24th, 2026
Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July. "Depending on the privileges granted to the TeamCity server process, a successful attack could expose TeamCity data, configurations, and stored credentials, modify server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines." Almost two weeks later, on August 5, CISA added CVE-2026-63077 to its catalog of actively exploited vulnerabilities and ordered U.S. federal agencies to secure their networks against ongoing attacks within three days. JetBrains confirmed that the flaw was exploited in the wild on August 7, shared indicators of compromise, and urged customers who couldn't immediately patch their servers to limit access to trusted networks. Now exploited in ransomware attacks While CISA has not yet shared inform
-
mentioned by www.bleepingcomputer.com
CISA: Ransomware gangs now exploiting critical TeamCity flaw https:// bleepingcomputer.com/news/security/ cisa-ransomware-gangs-now-exploiti
www.bleepingcomputer.com · 19d ago · September 24th, 2026
-
update from osintsights.com
Ransomware gangs exploit TeamCity flaw in targeted attacks A critical TeamCity vulnerability, now patched, could let attackers run malicious
osintsights.com · 19d ago · September 24th, 2026
Ransomware gangs exploit TeamCity flaw in targeted attacks A critical TeamCity vulnerability, now patched, could let attackers run malicious
via Mastodon https://osintsights.com/ransomware-gangs-exploit-teamcity-flaw-in-targeted-attacks?utm_source=mastodon&utm_medium=social
-
mentioned by www.bleepingcomputer.com
🤖 CISA: ransomware gangs now exploiting CVE-2026-63077, a critical JetBrains TeamCity auth-bypass flaw patched in July. Active exploitation
www.bleepingcomputer.com · 19d ago · September 24th, 2026
-
mentioned by radar.offseq.com
CVE-2026-63077 (CRITICAL): JetBrains TeamCity auth bypass lets unauthenticated attackers run OS commands. Ransomware gangs are actively expl
radar.offseq.com · 19d ago · September 24th, 2026
-
mentioned by www.bleepingcomputer.com
"CISA: Ransomware gangs now exploiting critical TeamCity flaw" "[...] Cybersecurity and Infrastructure Security Agency (CISA) warned federal
www.bleepingcomputer.com · 19d ago · September 24th, 2026
-
update from www.bleepingcomputer.com
Patch TeamCity to the latest version immediately and comb your logs for exploitation indicators before the next dungeon floor loads without
www.bleepingcomputer.com · 19d ago · September 24th, 2026
Patch TeamCity to the latest version immediately and comb your logs for exploitation indicators before the next dungeon floor loads without
via Mastodon https://www.bleepingcomputer.com/news/security/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/
-
mentioned by cyberworldops.eu
CISA added CVE-2026-63077 to the KEV catalog after confirming active exploitation in ransomware operations. The flaw allows unauthenticated
cyberworldops.eu · 19d ago · September 24th, 2026
-
mentioned by cyber.netsecops.io
📰 CISA: Ransomware Gangs Actively Exploiting Critical TeamCity RCE Flaw CISA confirms ransomware gangs are exploiting a critical RCE flaw (C
cyber.netsecops.io · 16d ago · September 27th, 2026
-
update from en.hacks.gr
CISA has confirmed that a serious JetBrains TeamCity flaw is being used in real extortion attacks. Fixes for the affected branches were rele
en.hacks.gr · 16d ago · September 27th, 2026
CISA has confirmed that a serious JetBrains TeamCity flaw is being used in real extortion attacks. Fixes for the affected branches were rele
via Mastodon https://en.hacks.gr/omades-ekviasmoy-chtypoyn-to-teamcity-peripoy-160-egkatastaseis-paramenoyn-ektetheimenes/