Imagine leaving your front door unlocked, except the door is your entire software build pipeline and the burglar doesn't even need to jiggle the handle. That's essentially what's happening to unpatched JetBrains TeamCity servers right now, and CISA is not being subtle about how bad it is.
A 9.8-Out-of-10 Bug With No Password Required
CVE-2026-63077 is a deserialization flaw in on-premise TeamCity servers that lets an unauthenticated attacker — no login, no credentials, nothing — bypass authentication entirely and execute arbitrary OS commands with the privileges of the TeamCity server process. It scores a 9.8 out of 10 on the CVSS scale, which is about as close to "just take the keys" as vulnerability ratings get.
The root cause lives in TeamCity's agent polling protocol: an unsafe XStream deserialization allowlist that failed to strip default permissions before applying its own restrictions, leaving a gap wide enough to drive arbitrary commands through. CISA added it to its Known Exploited Vulnerabilities catalog on August 5 with an unusually tight remediation deadline of August 8 — federal-agency speak for "drop what you're doing."
Why Your CI/CD Server Is the Juiciest Target in the Building
TeamCity servers aren't just another box on the network — they're the beating heart of the build-and-release pipeline, often holding stored credentials, source access, and the keys to whatever gets shipped downstream. Compromise one and you're not just in a server, you're potentially positioned to slip malicious code into every product that server builds, which is the exact supply-chain nightmare security teams have been losing sleep over since SolarWinds.
A working proof-of-concept is already public, courtesy of Rapid7, so the gap between "vulnerability disclosed" and "script kiddies having a field day" is measured in days, not weeks. JetBrains has patches out — TeamCity 2026.1.3 and 2025.11.7 — so if your build server is still on an older version, this is the kind of update you do before lunch, not after the next sprint.
Nine-point-eight severity, no password needed, and a live proof-of-concept in the wild — patch first, ask questions later.
If this kind of thing keeps you up at night, grab our free Developer's Security Checklist — or just talk to us directly.
Source: The Hacker News