IntelliOSPANDAModule|AICVE Watch BriefCVE-2026-63077
What TeamCity does, why compromise matters, and the known-exploited unauthenticated RCE
Research Framing
| Research field | Finding / method |
|---|---|
| Decision question | Which TeamCity On-Premises servers were reachable while vulnerable, which are on a fixed build or protected by the vendor plugin, and which need compromise assessment because CISA now confirms exploitation? [1][3][7] |
| Interpreted questions | Scope, version boundary, server reachability, exploit prerequisites, server-process privilege, KEV timing, local evidence, downstream CI/CD trust, remediation proof, and uncertainty about actors, victims, ransomware, and public exploit material. |
| Tier 0 through Tier 8 coverage | Tier 0: CISA KEV, BOD guidance, NVD/CVE, and MITRE CWE retained. Tier 1: JetBrains advisory, fixed-issues register, upgrade, and security documentation retained. Tier 2: Practitioner research checked; no issue-specific telemetry with a stronger evidentiary contribution than KEV was required for controlling facts. Tier 3: Security media checked only for discovery; not used to control facts. Tier 4: Community claims checked and excluded as unverified. Tier 5: No user-defined custom source supplied. Tier 6: No private integration or keyed telemetry queried. Tier 7: Carved vendor documentation retained for upgrade and hardening context. Tier 8: Expansion research checked for exploitation details and observables; unsupported claims were excluded. |
| Decision standard | Keep fact, inference, and local verification separate. Affected is not exposed; exposed is not exploited; patched is not clean; KEV confirms exploitation somewhere but does not identify the organization, actor, method details, or impact. |
| Research cutoff | 9 Aug 2026, America/New_York. JetBrains disclosed no known active exploitation on 27 Jul; CISA later added the CVE to KEV on 5 Aug. The later government status supersedes the earlier disclosure-time boundary for current exploitation status. [1][3] |
CVE-2026-63077 Watch Snapshot
| Decision field | Current answer | Owner implication |
|---|---|---|
| Product scope | All TeamCity On-Premises versions; TeamCity Cloud requires no customer action. [1] | Inventory self-hosted servers, including test, disaster-recovery, and externally managed instances. |
| Fixed state | 2025.11.7 or 2026.1.3; a security patch plugin is available for 2017.1+. [1][2] | Prefer full upgrade; document plugin coverage only when upgrade cannot occur. |
| Exploitation | CISA KEV added 5 Aug 2026; federal due date 8 Aug 2026. [3][6][7] | The due date has passed; treat unresolved reachable servers as overdue priority work. |
| Impact | Unauthenticated OS command execution as the TeamCity server process; potential data, configuration, credential, build-artifact, and pipeline compromise. [1] | Scope the CI/CD trust graph, not only the host. |
| Severity / weakness | CNA CVSS 3.1 9.8 Critical; CWE-502. [2][4][5][8] | Network reachable, low complexity, no privileges or user action; prioritize by reachability and business trust. |
| Current uncertainty | No authoritative issue-specific actor, named victim, ransomware campaign, or concrete IOC set is public in the retained sources. CISA ransomware use is Unknown. [3] | Use behavior and local evidence; do not invent attribution or assume absence of compromise. |
1-Topic
Product and vendor background: JetBrains is a global software company that makes tools for developers and development teams. TeamCity is its continuous integration and continuous delivery (CI/CD) product—a central build server that watches source-code repositories, directs build agents to compile and test code, collects results, stores build artifacts, and can advance approved software toward deployment. TeamCity is offered as customer-managed TeamCity On-Premises and as the JetBrains-hosted TeamCity Cloud service. [11][12]
That role makes TeamCity comparable to the control room of a software factory: it may be trusted by source repositories, build systems, package and artifact stores, code-signing services, cloud accounts, and production deployment pipelines. A compromise can therefore extend beyond one server into the integrity of software the organization builds or distributes.
The current problem: CVE-2026-63077 is a critical vulnerability in TeamCity On-Premises. JetBrains says an unauthenticated attacker who can reach a server over HTTP or HTTPS can abuse the agent polling protocol to bypass authentication checks and run operating-system commands with the privileges of the TeamCity server process. It affects every on-premises version before the fixed releases; TeamCity Cloud was already protected. [1][2][4]
This is a continuing decision product because the material status changed after disclosure: JetBrains reported no known exploitation on 27 July, while CISA added the issue to KEV on 5 August. Owners now need a time-bounded answer on inventory, reachability, fixed state, forensic triage, and downstream build trust. [1][3][7]
2-Persona / Audience Lens
| Audience | Decision | Proof required |
|---|---|---|
| Executives / risk owners | Accept continued operation, isolate, or invoke incident response. | Asset count, exposure window, fixed-state evidence, findings, CI/CD blast radius, and accountable owner. |
| Platform / DevOps | Upgrade, apply plugin, restrict access, and validate server-agent operation. | Pre/post build numbers, plugin state, restart where required, health checks, and network policy. |
| SOC / DFIR | Determine whether reachable vulnerable servers show command execution or follow-on control. | Preserved TeamCity, proxy, host, EDR, identity, VCS, secret-store, artifact, and agent telemetry. |
| Legal / insurance | Decide notification, coverage, and evidence-preservation obligations from local facts. | Timeline, systems and data reached, privilege and secret exposure, affected customers, and source-qualified statements. |
3-BLUF
- JetBrains is a major developer-tools company, and TeamCity is its CI/CD build-and-deployment orchestration product. The TeamCity server sits between source code and released software, coordinating builds, tests, artifacts, agents, and sometimes production deployments; compromise can therefore become a software supply-chain event. [11][12]
- CISA added CVE-2026-63077 to KEV on 5 Aug 2026, confirming exploitation in the wild; its 8 Aug federal required-action date has passed. [3][6][7]
- All TeamCity On-Premises versions are affected before 2025.11.7 and 2026.1.3. TeamCity Cloud requires no customer action. [1][2]
- The flaw is unauthenticated remote code execution through the agent polling protocol for any attacker with HTTP(S) reachability; commands run with the TeamCity server process privileges. [1][4][5]
- The CNA score is CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the vendor maps it to CWE-502, deserialization of untrusted data. [2][4][8]
- Upgrade to 2025.11.7 or 2026.1.3. If upgrade is temporarily impossible, JetBrains provides a security patch plugin for TeamCity 2017.1+; older 2017.1–2018.1 servers require restart after installation. [1][9]
- Do not assume the server is protected because security updates are “automatic.” Newer TeamCity releases can automatically download the patch and notify administrators, but an administrator must review and apply it; full automatic upgrades are optional and unavailable for some installation types. Verify the running build or enabled patch directly. [1][9][10]
- Do not close an internet-reachable pre-fix server on version evidence alone. Preserve and review server, reverse-proxy, host/EDR, identity, VCS, artifact, secret, and build-agent activity, then assess downstream pipeline integrity. [1][7][10]
- No reliable issue-specific IP addresses, domains, exploit URLs, malicious filenames, or hashes are public in the retained primary-source set; detection must be behavioral and environment-specific. [1][3][4]
- No authoritative retained source names an actor, public victim, ransomware campaign, or successful-compromise count. CISA lists ransomware use as Unknown, which is not evidence of absence. [3]
4-Executive Summary
JetBrains is a global software company best known for tools used by software developers and engineering teams. TeamCity is JetBrains' continuous integration and continuous delivery platform. In ordinary operation, a TeamCity server monitors code repositories, launches automated build and test work on connected agents, collects results, stores or publishes build artifacts, and may trigger deployment stages. Organizations can operate it on their own infrastructure as TeamCity On-Premises or use the JetBrains-hosted TeamCity Cloud service. [11][12]
Because TeamCity helps turn source code into software releases, it is often trusted by source repositories, build configurations, credentials, signing material, artifact repositories, cloud services, deployment systems, and connected build agents. CVE-2026-63077 therefore combines direct server compromise with a possible software-delivery and downstream trust problem. The business question is not simply whether a web application was vulnerable; it is whether an attacker could use the software factory's control room to steal code or secrets, alter trusted build output, reach production, or distribute compromised software downstream. [1][10][11]
JetBrains disclosed the issue on 27 July 2026 after private reporting on 10 July. The vendor says an unauthenticated attacker with HTTP(S) access can abuse the TeamCity agent polling protocol, bypass authentication checks, and execute arbitrary operating-system commands with the privileges of the TeamCity server process. The advisory does not publish exploit-request details. All TeamCity On-Premises versions are affected, while TeamCity Cloud customers require no action because protective measures were already applied. [1][2]
The fixed releases are TeamCity 2025.11.7 and 2026.1.3. JetBrains also released a vulnerability-specific security patch plugin for TeamCity 2017.1 and later when an immediate full upgrade is not possible. That plugin is a bridge, not a general substitute for upgrading: it addresses this CVE only. Administrators should preserve pre-change evidence, back up according to vendor guidance, record the exact build and plugin state, complete the change, and validate server and agent operation afterward. [1][9]
Automatic updating does not remove the need for verification. TeamCity 2024.03 and newer can automatically download available security patch plugins and notify administrators, but an administrator must still review and apply a pending patch. Full-version automatic updating is a separate, administrator-initiated option and is not supported for every installation type, including Docker deployments. TeamCity Cloud is different: JetBrains applied the necessary protection for customers. [1][9][10]
The JetBrains CNA score is CVSS 3.1 9.8 Critical with network reachability, low attack complexity, no privileges, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact. JetBrains maps the issue to CWE-502, deserialization of untrusted data. That class explains the unsafe trust boundary at a high level; it does not publish the serialized object shape, exploit packet, implementation class, or full code path. Defenders should use the classification to understand risk, not to fabricate signatures. [2][4][5][8]
The current exploitation assessment must be read chronologically. At disclosure, JetBrains said it was unaware of active exploitation. CISA added the CVE to KEV on 5 August, which is later authoritative evidence that exploitation has occurred in the wild, and set an 8 August federal action date under BOD 26-04. CISA also requires organizations in scope to follow its forensic-triage guidance. KEV membership does not identify the actor, victim, exploit volume, success rate, or post-exploitation objective. [1][3][6][7]
Detection should start with exposure and behavior. Establish which servers were reachable over HTTP(S), the relevant dates, server-process identity and privileges, and the systems or secrets that identity could access. Preserve TeamCity server and audit logs, reverse-proxy and load-balancer logs, host process and network telemetry, EDR alerts, file and configuration changes, new users or tokens, VCS and artifact-repository events, secret-store access, build-definition changes, unexpected builds, agent registration or tasking, and deployment activity. Baseline against legitimate administrative and build work, and treat telemetry gaps as uncertainty rather than a clean finding. [1][7][10]
Reliable primary sources currently provide no issue-specific malicious IP addresses, domains, exploit URLs, filenames, or file hashes. They also do not name a public victim, actor, ransomware campaign, or concrete payload. Accordingly, the brief publishes no concrete IOC values and recommends behavior-led hunting. If later primary reporting supplies validated indicators, they should be added with first-seen/last-seen dates, source binding, and explicit limits; until then, repurposing indicators from older TeamCity vulnerabilities would risk false attribution and missed activity. [1][3][4]
Response closure requires two proofs: the documented vulnerable path is fixed, and the pre-fix exposure did not become a material compromise—or, if it did, the affected trust has been rebuilt. Isolate or restrict reachable vulnerable servers, preserve evidence, upgrade or apply the vendor plugin, investigate the server and downstream CI/CD graph, rotate reachable credentials and signing material when compromise is plausible, validate repositories and artifacts, rebuild from trusted media if integrity cannot be established, and document residual uncertainty. [1][7][9][10]
5-Why It Matters
TeamCity is not merely another website or developer dashboard. It coordinates the machinery that converts source code into tested, packaged, and sometimes production-deployed software. A TeamCity server may therefore hold credentials or trusted connections to repositories, build agents, artifact and package stores, cloud services, signing systems, and deployment targets. [10][11]
Successful code execution may expose configurations and stored credentials, modify the server, alter build inputs or outputs, implant malicious changes into trusted artifacts, or use deployment authority to reach production. If modified software is distributed externally, downstream customers can also inherit risk. The effect depends on the server process privileges and the trust granted to each integration. [1][10]
Assessment: internet reachability and high-trust integrations increase operational priority, but they do not prove exploitation. Conversely, private placement lowers unauthenticated reachability but does not excuse patching where untrusted networks, contractors, compromised endpoints, or proxy paths can reach the server.
6-Vulnerability Details
| Field | Source-backed fact | Interpretation limit |
|---|---|---|
| Identifier / vendor issue | CVE-2026-63077 / TW-102164. | One disclosed vulnerability; do not merge with older TeamCity CVEs. |
| Attack path | Unauthenticated RCE through the agent polling protocol over reachable HTTP(S). | No primary retained source publishes exploit syntax or request details. |
| Execution context | Privileges of the TeamCity server process. | Actual blast radius is deployment-specific. |
| Cloud | TeamCity Cloud requires no customer action; vendor applied measures and found no evidence of Cloud exploitation through this issue. | That statement does not clear customer-managed on-premises servers. |
7-Affected Products & Fixed Versions
| Product / branch | Affected | Fixed / action |
|---|---|---|
| TeamCity On-Premises 2026.1 | Before 2026.1.3 | Upgrade to 2026.1.3 or later. [1][2][4] |
| TeamCity On-Premises 2025.11 | Before 2025.11.7 | Upgrade to 2025.11.7 or later. [1][2][4] |
| Older TeamCity On-Premises | All versions; vendor plugin supported for 2017.1+ | Prefer upgrade to a current fixed release; if blocked, install the CVE-specific security patch plugin. Versions 2017.1–2018.1 require a server restart after plugin installation. [1][9] |
| TeamCity Cloud | Customer action not required | Vendor already applied necessary measures. [1] |
The CNA machine-readable range is terse; the JetBrains advisory is controlling for the statement that all on-premises versions are affected and for the branch-specific fix choices. Record exact pre/post build numbers rather than reporting only “latest.”
8-Severity and Operational Priority
The JetBrains CNA assigns CVSS 3.1 9.8 Critical: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It describes network access, low complexity, no credentials, no user interaction, unchanged security scope, and high impact across confidentiality, integrity, and availability. NVD had not added an independent NIST score at the research cutoff. [2][4][5]
Operational priority should combine the score with KEV status, HTTP(S) reachability, server-process privilege, secrets and signing material reachable, production deployment authority, and logging coverage. Internet-reachable pre-fix servers with powerful pipeline trust are highest priority; lower exposure changes sequencing, not affected status.
9-CWE Weakness Classification
JetBrains maps CVE-2026-63077 to CWE-502, Deserialization of Untrusted Data. MITRE defines the class around deserializing untrusted data without adequate verification that the resulting data is valid, allowing attacker-controlled objects or data structures to produce unintended behavior. [2][8]
Limit: CWE-502 is a taxonomy label, not a packet signature or full root-cause disclosure. The retained primary sources do not publish the serialized format, class names, gadget chain, payload, or exact parser path. Detection guidance must remain behavioral unless JetBrains or another reliable issue-specific source releases more detail.
10-KEV and Exploitation Status
| Question | Current answer | Boundary |
|---|---|---|
| Known exploitation? | Yes. CISA added the CVE to KEV on 5 Aug 2026. [3] | Confirms exploitation somewhere, not local compromise or campaign scale. |
| Required date? | 8 Aug 2026 for covered federal civilian agencies. [3][6][7] | Passed as of publication; non-federal entities must determine their own legal obligations. |
| Ransomware use? | Unknown in CISA KEV. | Unknown is neither confirmed use nor proof of no use. |
| Public exploit / PoC? | No reliable primary source retained for this brief publishes one. | Absence from retained sources is not a claim that no exploit code exists anywhere. |
| Why did status change? | JetBrains knew of no exploitation on 27 Jul; CISA's later 5 Aug KEV action supplies the current controlling status. | Preserve both dated facts; do not call the vendor statement erroneous. |
11-Technical Preconditions and Attack Flow
- Reach: attacker can make HTTP(S) requests to TeamCity On-Premises.
- Trigger: attacker targets the TeamCity agent polling protocol; no authentication or user action is required.
- Boundary failure: unsafe handling mapped to CWE-502 permits authentication checks to be bypassed.
- Execution: arbitrary operating-system commands run as the TeamCity server process.
- Possible impact: depending on local privilege and integrations, the attacker may access data, configuration, credentials, build artifacts, agents, or downstream pipelines.
Steps 1–4 are vendor/CNA facts. Step 5 is a vendor-described conditional impact and must be verified locally; it is not proof that every exploited server suffered every outcome. [1][2][4][8]
12-Observables and Evidence
| Category | Issue-specific public value | Behavioral evidence to collect |
|---|---|---|
| IP addresses | Not publicly available from a reliable retained issue-specific source. | Source addresses reaching TeamCity during the vulnerable window; correlate with proxy, firewall, host, and authentication context. |
| Domains / FQDNs | Not publicly available from a reliable retained issue-specific source. | Unexpected outbound resolution or connections by the TeamCity server process and child processes. |
| Exploit URLs / paths | No concrete exploit URL is public in the retained primary sources; only the agent polling protocol is named. | Anomalous unauthenticated polling traffic, unusual response codes, bursts, or client patterns; preserve raw HTTP metadata where lawful. |
| Filenames / file names | No malicious filename is public in a reliable retained issue-specific source. | Unexpected file creation or modification in TeamCity install/data paths, temporary directories, service startup locations, plugins, and build configuration. |
| Hashes / SHA-256 | No malicious hash is public in a reliable retained issue-specific source. | Hash newly created executables, scripts, plugins, archives, and modified configuration for internal scoping and later enrichment. |
| High-value evidence | Environment-specific rather than universal IOC. | Child processes, command lines, network connections, new accounts/tokens, configuration changes, unusual builds, agent actions, VCS/artifact changes, secret access, and deployment events. |
13-Detection and Hunting
| Surface | Hunt question | Caution |
|---|---|---|
| Proxy / HTTP | Which unauthenticated clients reached TeamCity, especially agent-polling functions, before the fixed state? Are there anomalous methods, sizes, rates, or responses? | The public advisory does not provide a safe exact exploit signature. |
| Host / EDR | Did the TeamCity server process spawn unusual shells, interpreters, utilities, downloaders, or child-process trees, or make unexpected outbound connections? | Build systems legitimately execute many tools; baseline against job context. |
| TeamCity | Were users, tokens, plugins, projects, build configurations, permissions, agents, or server settings changed outside approved administration? | Account for automation and maintenance windows. |
| VCS / artifacts / deployment | Were commits, build inputs, artifacts, signing actions, registry uploads, or deployments changed or produced by unexplained server activity? | Validate integrity from trusted source and provenance, not timestamps alone. |
| Identity / secret stores | Did the server identity or reachable credentials access repositories, clouds, registries, signing systems, or production unusually? | Telemetry gaps preserve uncertainty; do not label them clean. |
14-Incident Response Playbook
| Phase | Action | Closure evidence |
|---|---|---|
| 0–2 hours | Identify every on-premises server, exact build, HTTP(S) exposure, owner, server identity, agents, and connected repositories, registries, clouds, signing and deployment systems. Restrict reachability without destroying evidence. | Asset/exposure map and preserved network configuration. |
| 0–4 hours | Preserve TeamCity, proxy, system, EDR, network, identity, VCS, artifact, secret-store, agent, and deployment telemetry before upgrade or cleanup. | Time-bounded collection manifest with hashes and custody notes. |
| Same day | Upgrade to 2025.11.7 or 2026.1.3; if genuinely blocked, install the vendor plugin for 2017.1+ and restart versions that require it. Validate fixed state and service health. | Pre/post build or plugin proof, change record, restart evidence, health checks. |
| Same day–72 hours | Hunt for suspicious command execution, persistence, credential use, project and pipeline change, artifact tampering, agent abuse, and downstream access. Rotate reachable trust where compromise is plausible. | Analyst findings, scoped systems/secrets, rotations, artifact/provenance validation. |
| Recovery | If server or pipeline integrity cannot be established, rebuild from trusted media/configuration and regenerate affected secrets or signing material; monitor restored services. | Known-good rebuild and signed return-to-service decision with residual uncertainty. |
15-Decision-Ready Actions
- Name one accountable owner for on-premises TeamCity inventory, exposure, remediation, and incident closure. [3][7]
- Upgrade every affected server to 2025.11.7 or 2026.1.3; use the CVE-specific plugin only as a documented bridge when a full upgrade cannot occur. [1][9]
- Remove direct internet reachability where possible; require trusted networks, VPN, or an additional access layer. Run the server with least OS privilege and separate it from build agents. [1][10]
- For every reachable pre-fix server, perform forensic triage and map server-process authority to secrets, code, artifacts, agents, and deployments. [1][7]
- Do not use “patched” as incident closure when evidence indicates exploitation or telemetry is insufficient to establish integrity.
- Track future JetBrains, CISA, and canonical CVE changes for issue-specific indicators, technical details, actors, victims, and ransomware status.
16-SMB, MSP, and Insurance Lens
| Lens | Risk | Decision evidence |
|---|---|---|
| SMB | A small team may run TeamCity with broad credentials and limited EDR or proxy retention. | Inventory, fixed build, reachability history, backup, privileged integrations, affordable log preservation, and vendor/plugin support. |
| MSP / managed DevOps | Shared administration and templates can create multi-customer scope, but one vulnerable server does not prove every customer was affected. | Customer-by-customer server, exposure, credentials, agents, repositories, artifacts, findings, and closure records. |
| Cyber insurance / counsel | Potential code, credential, software-supply-chain, and production impact can cross coverage and notification domains. | Dated facts, preservation steps, confirmed access, data and customer scope, artifact integrity, rotations, recovery cost, and uncertainty; avoid claiming actor or ransomware without evidence. |
17-Timeline of Notable Activity
| Date | Event | Decision meaning |
|---|---|---|
| 10 Jul 2026 | Antoni Tremblay privately reports the vulnerability to JetBrains. [1] | Coordinated disclosure begins. |
| 27 Jul 2026 | JetBrains publishes fixes and advisory; CVE/NVD record appears. Vendor says it is not aware of active exploitation at publication. [1][2][4][5] | Patch clock begins; exploitation is not then vendor-confirmed. |
| 5 Aug 2026 | CISA adds CVE-2026-63077 to KEV. [3] | Later evidence establishes known exploitation and triggers BOD 26-04 action/triage. |
| 8 Aug 2026 | CISA federal required-action date. [3][6][7] | Deadline is past at publication; unresolved covered assets are overdue. |
| 9 Aug 2026 | IntelliOS reconciles current primary sources and publishes v1. | No reliable public issue-specific IOC set, actor, victim, or ransomware linkage is retained. |
18-Public Victim and Attribution Matrix
| Claim category | Public status | Publication boundary |
|---|---|---|
| Named public victims | None identified in retained authoritative sources. | Do not infer victims from internet exposure, scanning, or product ownership. |
| Threat actor / campaign | Unattributed in retained authoritative sources. | Do not reuse actor labels from older TeamCity incidents. |
| Ransomware | CISA KEV value: Unknown. | State Unknown; do not convert it to yes or no. |
| Observed impacts | CISA confirms exploitation; no primary retained source quantifies victims or publishes a case outcome. | Describe vendor-stated potential impacts separately from observed exploitation. |
| Local organization | Unassessed until inventory, exposure, and evidence review are complete. | Use affected, exposed, suspicious, and confirmed as separate states. |
19-Common Questions
| Question | Answer |
|---|---|
| What is TeamCity? | A CI/CD or build server made by JetBrains. It watches source-code changes, coordinates automated builds and tests, stores results and artifacts, and can participate in deploying software. [11] |
| What is JetBrains? | A global software company that develops tools for programmers and development teams, including TeamCity, IntelliJ IDEA, PyCharm, WebStorm, and other products. [12] |
| Why can one TeamCity compromise affect other systems? | The server may hold credentials and trusted connections to code repositories, build agents, package and artifact stores, signing services, cloud accounts, and production deployments. The actual downstream scope is environment-specific. |
| Is TeamCity Cloud affected? | JetBrains says customers need no action; measures were applied and it found no Cloud exploitation through this issue. [1] |
| Are all self-hosted versions affected? | Yes. Upgrade to 2025.11.7 or 2026.1.3; a CVE-specific plugin exists for 2017.1+. [1][2] |
| Does KEV mean our server was hacked? | No. It confirms exploitation in the wild, not local compromise. |
| Does patching prove we are clean? | No. It fixes the documented path. Reachable pre-fix systems still need evidence-led compromise assessment. |
| What exact IOC should we block? | No reliable issue-specific IP, domain, URL, filename, or hash is public in the retained primary sources. Use exposure and behavioral hunting. |
| Is the plugin equivalent to upgrading? | It patches this CVE, but JetBrains recommends upgrading for other security updates. [1][9] |
| Will TeamCity patch itself automatically? | Do not assume so. Newer versions can automatically download security patches and notify administrators, but an administrator must apply them. Full-version automatic updates are optional and do not support every installation type. Verify the running version or active patch. [1][9][10] |
20-Source Weighting and Contribution
| Source | Weight | Contribution / limit |
|---|---|---|
| [1] JetBrains | Very high — controlling | Controlling vendor advisory for scope, attack path, fixes, mitigation, impact, and disclosure-time exploitation boundary. |
| [2] JetBrains | Very high — controlling | Vendor security register for TW-102164, CVE, severity, fixed builds, and CWE. |
| [3] CISA | Very high — controlling | Controls known-exploitation status, due date, required action, and ransomware-use value. |
| [4] NIST NVD | High — canonical/framework | Corroborates the CNA record, CVSS vector, CWE-502, affected boundary, and CISA SSVC snapshot. |
| [5] CVE Program / JetBrains CNA | High — canonical/framework | Canonical identifier and CNA-supplied vulnerability data. |
| [6] CISA | High — canonical/framework | Federal action framework referenced by the KEV record. |
| [7] CISA | High — canonical/framework | Controls federal forensic-triage expectations and exposure-based prioritization. |
| [8] MITRE CWE | High — canonical/framework | Defines the vendor-assigned weakness class and its interpretation limits. |
| [9] JetBrains | High — vendor operations | Vendor operational guidance for backup, upgrade, agents, and security patch plugins. |
| [10] JetBrains | High — vendor operations | Vendor hardening context for server/agent privilege and deployment boundaries. |
| [11] JetBrains | High — vendor operations | Primary product context: explains how a CI/CD or build server watches source control and coordinates automated build, test, artifact, and deployment work. |
| [12] JetBrains | High — vendor operations | Primary vendor context: identifies JetBrains as the global developer-tools company that makes TeamCity and other software-development products. |
Fact hierarchy: the current JetBrains advisory controls product behavior and mitigation; CISA KEV controls known-exploitation status, required action, due date, and ransomware value; CVE/NVD corroborate CNA fields; CWE defines taxonomy; vendor documentation supports implementation. Discovery-only media and community claims were not promoted into facts.
21-Connected IntelliOS Products
Search the canonical vulnerability card library.
Exploitable Technology RiskCross-product known-exploitation prioritization.
No separate IntelliOS Flash Threat Brief or actor/campaign product was identified for this CVE at publication. External monitoring remains anchored to JetBrains and CISA. [1][3]
22-Notes
Create an account and sign-in to use this card.
Record your personal notes and comments in this card related to this brief.
23-Citations
| # / Tier | Primary source | Date | Contribution |
|---|---|---|---|
| 1 | JetBrains — Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077) | Tier 1 · 27 Jul 2026 | Controlling vendor advisory for scope, attack path, fixes, mitigation, impact, and disclosure-time exploitation boundary. |
| 2 | JetBrains — Security issues fixed | Tier 1 · Checked 9 Aug 2026 | Vendor security register for TW-102164, CVE, severity, fixed builds, and CWE. |
| 3 | CISA — Known Exploited Vulnerabilities Catalog — CVE-2026-63077 | Tier 0 · Added 5 Aug 2026 | Controls known-exploitation status, due date, required action, and ransomware-use value. |
| 4 | NIST NVD — CVE-2026-63077 | Tier 0 · Published 27 Jul; modified 28 Jul 2026 | Corroborates the CNA record, CVSS vector, CWE-502, affected boundary, and CISA SSVC snapshot. |
| 5 | CVE Program / JetBrains CNA — Canonical CVE-2026-63077 record | Tier 0 · Checked 9 Aug 2026 | Canonical identifier and CNA-supplied vulnerability data. |
| 6 | CISA — BOD 26-04 — Prioritizing Security Updates Based on Risk | Tier 0 · 2026 | Federal action framework referenced by the KEV record. |
| 7 | CISA — BOD 26-04 Implementation Guidance and Forensics Triage Requirements | Tier 0 · 2026 | Controls federal forensic-triage expectations and exposure-based prioritization. |
| 8 | MITRE CWE — CWE-502 — Deserialization of Untrusted Data | Tier 0 · Checked 9 Aug 2026 | Defines the vendor-assigned weakness class and its interpretation limits. |
| 9 | JetBrains — Upgrading TeamCity Server and Agents | Tier 1 · TeamCity 2026.1 documentation | Vendor operational guidance for backup, upgrade, agents, and security patch plugins. |
| 10 | JetBrains — TeamCity Security Notes | Tier 1 · Checked 9 Aug 2026 | Vendor hardening context for server/agent privilege and deployment boundaries. |
| 11 | JetBrains — What is a CI server? | Tier 1 · Checked 9 Aug 2026 | Primary product context: explains how a CI/CD or build server watches source control and coordinates automated build, test, artifact, and deployment work. |
| 12 | JetBrains — About JetBrains | Tier 1 · Checked 9 Aug 2026 | Primary vendor context: identifies JetBrains as the global developer-tools company that makes TeamCity and other software-development products. |
24-Version Change Log
| Version | Date | Material change | Basis |
|---|---|---|---|
| v2 | 9 Aug 2026 | Added plain-English JetBrains and TeamCity background before the vulnerability; explained the CI/CD server's normal role, software-factory analogy, downstream compromise paths, deployment-model distinction, and why automatic patch download does not equal an installed fix. | [1][9][10][11][12] |
| v1 | 9 Aug 2026 | Initial continuing CVE Watch publication. Reconciled the vendor's disclosure-time no-known-exploitation statement with CISA's later KEV addition; documented all on-premises scope, fixed builds and plugin path, due date, CVSS/CWE, exposure and behavioral detection, incident response, SMB/MSP/insurance decisions, explicit IOC unavailability, and attribution/victim/ransomware boundaries. | [1][2][3][4][5][6][7][8][9][10] |
Monitoring rule: publish a new version only for a material primary-source change such as new fixed-version guidance, vendor technical or detection detail, a validated issue-specific IOC, changed KEV/ransomware status, or authoritative actor/victim/impact reporting. No-change checks do not create versions.