Nothing ruins a Tuesday like finding out the server that builds and deploys your entire codebase can be hijacked by a total stranger who doesn't even need a password. That's the situation JetBrains TeamCity users found themselves in this week, and CISA just made it official: this one's being actively exploited in the wild.
A 9.8-Out-of-10 Problem With No Login Required
CVE-2026-63077 is a critical deserialization flaw in on-premise TeamCity servers, carrying a CVSS score of 9.8 — about as bad as these ratings get. Rapid7's analysis traced the root cause to a misconfigured XStream allowlist that left default, overly permissive settings intact, letting an unauthenticated attacker abuse the agent polling protocol to run arbitrary OS commands with the server's own privileges.
JetBrains patched the hole in TeamCity 2026.1.3 and 2025.11.7 in late July, initially reporting no evidence of active exploitation. That changed fast: CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 5, and federal agencies were given until August 8 to patch or mitigate under Binding Operational Directive 26-04.
Why a Build Server Is the Ultimate Skeleton Key
TeamCity isn't some peripheral app — it's the machine that touches your source code, your secrets, your deployment credentials, and everything you're about to ship to production. Compromise it, and an attacker doesn't need to break into your app; they can just quietly poison the pipeline that builds it, turning every downstream deployment into a potential Trojan horse.
The scariest part is the "unauthenticated" bit. No phishing email, no stolen password, no social engineering required — just network access to a vulnerable server. If your TeamCity instance is reachable from the internet and unpatched, you're not hoping to avoid attackers, you're hoping they haven't gotten around to you yet.
If you're running TeamCity on-premise and haven't updated since July, today's the day — before your build pipeline becomes someone else's supply chain attack.
Got a Drupal site (or one that should be)? Let's chat.
Source: The Hacker News