CISA Warns of Active Exploitation in JetBrains TeamCity Vulnerability

WASHINGTON — The Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert on Thursday warning that cyber attackers are actively exploiting a critical security flaw in JetBrains TeamCity, a widely used continuous integration server. The vulnerability, cataloged as CVE-2026-63077, allows for unauthenticated remote code execution, enabling malicious actors to take complete control of affected systems without needing valid login credentials.

CISA stated that the threat is immediate and ongoing. Because the flaw requires no authentication, any TeamCity instance exposed to the internet or accessible via an internal network is at risk. Attackers who successfully exploit this vulnerability can execute arbitrary code on the server, potentially leading to data theft, ransomware deployment, or the use of compromised infrastructure as a launchpad for further attacks within corporate networks.

JetBrains, the developer behind TeamCity, has released patches addressing CVE-2026-63077. The agency urged administrators and organizations using the software to apply updates immediately if they have not already done so. CISA emphasized that delaying remediation leaves systems vulnerable to active exploitation campaigns currently underway.

The alert comes as part of a broader effort by federal cybersecurity officials to protect critical infrastructure from known vulnerabilities being weaponized in real-time. TeamCity is utilized extensively across the technology sector for automating software build, test, and deployment processes. A compromise of these servers could disrupt development cycles and expose sensitive intellectual property or source code.

Security experts note that unauthenticated remote code execution flaws are among the most severe categories of vulnerabilities due to their ease of exploitation. Unlike attacks requiring stolen passwords or social engineering, this specific flaw can be triggered by sending a malicious request directly to the server's endpoint. The speed at which attackers have moved from discovery to active weaponization underscores the urgency of patching.

CISA did not disclose whether any major organizations had already been compromised through CVE-2026-63077, nor did it identify specific threat actor groups responsible for the exploitation attempts. The agency also declined to comment on the origin or motivation behind the attacks targeting this specific software component.

As of Thursday morning, no confirmed incidents involving widespread disruption had been publicly reported by major technology firms using TeamCity instances. However, security researchers advise that the absence of public reports does not guarantee safety, as many breaches remain undetected for months before discovery.

Questions remain regarding the full scope of the exploitation campaign and whether attackers have developed additional methods to bypass existing mitigation strategies beyond standard patching. CISA continues to monitor global threat feeds for new indicators of compromise related to this vulnerability while urging organizations to verify their systems are fully updated.