CISA’s KEV listing moves TeamCity from a patchable server bug to proof that the build control plane is already being hit. The weak point is the agent polling trust path, where an unauthenticated request can ride in as trusted data and reach the TeamCity server process, so patching the host alone does not capture the blast radius.
CVE-2026-63077 is a deserialization of untrusted data flaw in TeamCity On-Premises. JetBrains fixed it in 2026.1.3 and 2025.11.7, and released a security patch plugin for 2017.1+, but CISA has now added it to KEV and said it is actively exploited, which conflicts with JetBrains’ earlier statement that it had seen no active exploitation. A compromised server can expose stored credentials, configurations, and build trust, and that risk reaches downstream CI/CD pipelines, not just the TeamCity box.