CVE-2026-63077: Additional Guidance Following Reports of Active Exploitation - The JetBrains Blog

JetBrains reports active and attempted exploitation of CVE-2026-63077 against unpatched TeamCity servers and urges customers to immediately upgrade to TeamCity 2025.11.7 or 2026.1.3, or install the available security patch plugin for versions 2017.1 and later if an upgrade is not immediately possible. The unauthenticated vulnerability can be exploited through the agent polling protocol by attackers with HTTP(S) access, potentially allowing arbitrary operating-system command execution under the TeamCity server process and exposing data, credentials, configurations, build artifacts, and downstream CI/CD pipelines. Administrators are advised to investigate server logs for ConversionException messages, which may indicate attempted or successful exploitation, and ForbiddenClassException messages after patching, which indicate blocked attempts; they should also review unauthorized build agents, especially those named with the prefix “scan.” TeamCity Cloud customers require no action because mitigations have already been applied, while self-hosted users unable to patch promptly should restrict external access and adopt longer-term measures including trusted-network access controls, minimum server privileges, VPNs or additional security layers, and separate hosts for TeamCity servers and build agents.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.