JetBrains TeamCity Vulnerability Now Under Active Exploitation

SecurityWeek reports that a critical vulnerability in JetBrains TeamCity, tracked as CVE-2026-63077, is now being actively exploited in the wild. The vulnerability allows unauthenticated remote code execution and affects multiple versions of the widely used continuous integration and deployment platform. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalogue, confirming that threat actors are targeting the flaw. JetBrains released patches in late July, but organisations that have not yet applied the update are now at immediate risk. TeamCity is used by development teams to automate build, test and deployment pipelines, meaning successful exploitation gives attackers access to source code, build environments, deployment credentials and often direct access to production infrastructure.

Why this matters for UK organisations

CI/CD platforms are high-value targets because they sit at the centre of the software development lifecycle and typically have privileged access to multiple environments. Exploitation of this vulnerability does not require authentication, meaning any internet-facing TeamCity instance is at risk. The fact that active exploitation is confirmed means this is no longer a theoretical risk, it is an active threat. Organisations that have not yet patched should assume that threat actors are actively scanning for vulnerable instances and should prioritise remediation immediately. For organisations that have already patched, this is a prompt to review whether any unauthorised access may have occurred before the patch was applied. The operational impact of a successful compromise could include unauthorised access to source code, injection of malicious code into build pipelines, theft of deployment credentials, and lateral movement into production environments. For many organisations, a compromise of the CI/CD platform represents a supply chain risk, as malicious code could be injected into software that is then deployed to customers.

What to review

Organisations using JetBrains TeamCity should confirm that patches have been applied across all instances, review access logs for any signs of unauthorised activity before the patch was applied, and ensure that CI/CD platforms are not directly exposed to the internet without additional access controls such as VPN or IP allowlisting. Consider whether your CI/CD environments have appropriate network segmentation, whether credentials used by build pipelines are rotated regularly, and whether you have visibility into what code is being built and deployed through these systems. This is also a prompt to review whether your CI/CD platforms have multi-factor authentication enabled for all users, whether build and deployment processes are logged and monitored, and whether you have tested your ability to detect and respond to unauthorised changes in your build pipelines. Organisations should also consider whether they have a process for reviewing and validating code that is deployed to production, and whether they can roll back deployments if malicious code is detected.

Source: SecurityWeek