CISA Issues Urgent Warning: Critical TeamCity Flaw Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical vulnerability within JetBrains TeamCity On-Premises installations, confirming that the flaw is currently being exploited in live attacks. This serious security defect, identified as CVE-2026-63077, allows unauthorized individuals to execute arbitrary code remotely on affected systems.

The vulnerability specifically targets TeamCity's on-premises deployments, a popular continuous integration and continuous delivery (CI/CD) server used by many organizations for automating software builds, tests, and deployments. The nature of CVE-2026-63077 means an attacker does not need to be authenticated to compromise a vulnerable server, significantly lowering the barrier for malicious activity.

CISA’s alert underscores the severity of the threat, as the agency typically issues such warnings when immediate action is required to protect federal networks and critical infrastructure. The confirmation of active exploitation elevates this particular vulnerability from a potential risk to an immediate danger, prompting system administrators to act swiftly.