Published on 7 August 2026
Attackers can currently take full control of TeamCity build servers without a single valid login – and with them, control of your entire software supply chain. On 5 August 2026, the US Cybersecurity agency CISA added the vulnerability CVE-2026-63077 in JetBrains TeamCity On-Premises to its catalogue of actively exploited security flaws. The reason: there are already confirmed attacks in the wild. US federal agencies must patch by 8 August 2026. Anyone running TeamCity themselves who has not yet acted should consider the update window to have already closed.
JetBrains TeamCity is a widely used tool for automating software development – a so-called CI/CD server (Continuous Integration/Continuous Delivery, i.e. the automated building and shipping of software). On 27 July 2026, JetBrains published a security advisory about a critical flaw in the self-hosted variant TeamCity On-Premises. The vulnerability carries the identifier CVE-2026-63077 and received a CVSS score of 9.8 out of a maximum of 10 – the highest risk level.
The timeline shows how quickly a reported flaw turned into an acute problem: security researcher Antoni Tremblay reported the vulnerability confidentially to JetBrains on 10 July 2026. Seventeen days later, on 27 July, the public advisory followed along with patched versions. Another 9 days later, on 5 August, CISA added the flaw to its Known Exploited Vulnerabilities Catalog (KEV, a list of demonstrably exploited vulnerabilities). On 7 August, JetBrains confirmed active exploitation in a follow-up advisory.
“Since our initial announcement on 27 July 2026, we have received reports of active exploitation as well as exploitation attempts against unpatched TeamCity servers.” – JetBrains (Daniel Gallo), follow-up advisory of 7 August 2026
The flaw lies in the so-called agent polling protocol. This is the communication channel through which the individual build agents (the machines that carry out the actual build tasks) ask the central TeamCity server for new jobs.
At its root is an insecure deserialization of untrusted data (technical term: Insecure Deserialization, CWE-502). Simply put: a program receives data in a packed format and “unpacks it again” (deserialises it) without first checking whether the data is safe. An attacker can send specially crafted Java objects to the server over HTTP(S). When they are unpacked, these objects are processed – without any authentication being required – and trigger the execution of arbitrary operating system commands. These commands run with the privileges of the TeamCity server process.
Technically, the XStream library is abused in the process. This is also important for detection: during an attack attempt, the entry com.thoughtworks.xstream.converters.ConversionException appears in the server log.
The CVSS rating is maxed out for good reason: the attack takes place over the network, the complexity is low, and no privileges and no user interaction are required. The impact on confidentiality, integrity and availability is “high” in each case. In concrete terms, a successful attack means: disclosure of all data and credentials stored in TeamCity, manipulation of the server state, and compromise of build artefacts as well as downstream pipelines.
“TeamCity controls the build pipelines at numerous software teams. If the server falls into the wrong hands, the downstream code can be manipulated. A successful attack can disclose stored credentials, alter the server state and tamper with build artefacts.” – AllAboutSecurity.de editorial team, 6 August 2026
Affected are all installations of JetBrains TeamCity On-Premises (self-hosted) in the following version states:
TeamCity Cloud customers are not affected: JetBrains has already secured the cloud environments automatically. Likewise, the flaw is not directly relevant to website operators who do not use TeamCity and have no CI/CD infrastructure of their own.
To give a sense of scale: according to ELP Data, around 20,554 companies worldwide use JetBrains TeamCity. According to 6sense, the product holds a share of roughly 4.93% of the CI/CD market; in JetBrains’ own “State of CI/CD 2025” survey, 7% of organisations reported using TeamCity. Instances that are directly reachable from the internet are particularly at risk.
com.thoughtworks.xstream.converters.ConversionException. This entry alone does not prove a compromise, but it can indicate an exploitation attempt or a successful attack and should be investigated.scan. This is a compromise indicator named by JetBrains.Given the confirmed active exploitation, haste is required. JetBrains already provided the full patches on 27 July 2026.
That TeamCity of all things is being targeted is no coincidence. Build servers are a key to the entire software supply chain – whoever controls them can deliver manipulated code to all downstream systems. The track record speaks a clear language:
“Since TeamCity vulnerabilities have been extensively exploited in the past, including by ransomware gangs and state-sponsored actors, administrators should take immediate action to mitigate the risks.” – Bill Toulas, BleepingComputer, 30 July 2026
SecurityWeek summarises the current situation: “Roughly a week after public disclosure, CISA added CVE-2026-63077 to its catalogue of actively exploited vulnerabilities and ordered federal agencies to patch within three days.” (Ionut Arghire, 6 August 2026)
For German SMEs, the flaw has a tangible legal dimension. If personal data is processed via the TeamCity server – for example developer credentials, customer data in build configurations, or API keys for services involving personal data – then in the event of a compromise the notification obligation under Art. 33 GDPR applies: a data breach must be reported to the competent data protection supervisory authority without undue delay, ideally within 72 hours of becoming aware of it, provided there is a risk to the rights and freedoms of natural persons. In the case of a successful attack via CVE-2026-63077, this risk is generally present, since attackers gain access to stored credentials and potentially all managed systems. In addition, under Art. 34 GDPR there may be an obligation to notify the affected individuals.
Particularly important: Art. 32 GDPR obliges controllers to take appropriate technical measures – this includes the timely installation of critical security updates. Anyone who fails to apply an available patch for a known critical flaw risks having this classified as a breach of duty. Fines are tiered: up to €10 million or 2% of worldwide annual turnover (Art. 83(4)), and for serious violations up to €20 million or 4% (Art. 83(5)).
For context: in Germany, a total of 10,259 data breaches were reported in 2025. The supervisory authorities imposed 249 fines with a total value of around €46.9 million – the highest single fine was €45 million (against Vodafone, for inadequate authentication processes). For SMEs, fines are usually considerably lower, but can nevertheless be existentially threatening.
CVE-2026-63077 is one of the most dangerous combinations there is: unauthenticated remote code execution with a maximum CVSS score, a central point of attack in the software supply chain – and a threat landscape in which, by experience, state actors and ransomware gangs exploit TeamCity flaws within days. The active exploitation has been confirmed by CISA and JetBrains. If you run TeamCity On-Premises, the priority is clear:
Cloud customers and companies without their own CI/CD infrastructure can breathe a sigh of relief – for everyone else, every hour now counts.