Vulnerabilities & Exploits · Zero-Day Exploit

TeamCity’s Build Control Plane Is Under Attack

CISA’s KEV listing moves TeamCity from a patchable server bug to proof that the build control plane is already being hit. The weak point is the agent polling trust path, where an unauthenticated request can ride in as trusted data and reach the TeamCity server process, so patching the host alone does not capture the blast radius.

CVE-2026-63077 is a deserialization of untrusted data flaw in TeamCity On-Premises. JetBrains fixed it in 2026.1.3 and 2025.11.7, and released a security patch plugin for 2017.1+, but CISA has now added it to KEV and said it is actively exploited, which conflicts with JetBrains’ earlier statement that it had seen no active exploitation. A compromised server can expose stored credentials, configurations, and build trust, and that risk reaches downstream CI/CD pipelines, not just the TeamCity box.

6 sources · Aug 7

CVE-2026-63077

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: in JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent…

CISA federal remediation date Aug 8

Timeline

Sources

Part of the PlainSec briefing for 2026-07-31

Every edition of this story: TeamCity’s Build Control Plane Is Under Attack

More from today