CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild

CVE-2026-63077 is a critical deserialization of untrusted data vulnerability in JetBrains TeamCity on-premise versions with a CVSS score of 9.8. An unauthenticated remote attacker can exploit this flaw via the TeamCity agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. A successful exploit can expose TeamCity data, configurations, and stored credentials, modify server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines. The exact exploitation method in the wild, threat actor identity, and scale of attacks are currently unknown.