JetBrains TeamCity Vulnerability Under Active Exploit — CISA Issues Alert

What Happened

CISA has added CVE-2026-63077, a deserialization vulnerability in JetBrains TeamCity, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild. Deserialization flaws allow attackers to execute arbitrary code by manipulating untrusted data, often leading to complete system compromise. While CISA's Binding Operational Directive (BOD) 26-04 mandates rapid remediation for federal agencies, the advisory strongly encourages all organizations to prioritize patching vulnerabilities on the KEV list.

Why SMBs Should Care

TeamCity is a popular CI/CD platform used by development teams to automate builds and deployments. If your organization uses TeamCity—especially if it's exposed to the internet—this vulnerability poses an immediate risk of total system takeover. Attackers exploiting CI/CD infrastructure can inject malicious code into your software supply chain, steal credentials, deploy ransomware, or pivot to other systems. For SMBs without dedicated security teams, these attacks can be devastating. Patch immediately, review access logs for signs of compromise, and consider segmenting your DevOps infrastructure from production environments. If TeamCity was compromised before patching, assume credential theft and potential backdoor installation.

Read the full CISA alert

Take Action

Not sure if your infrastructure is exposed or need help assessing your DevOps security posture? O-Cyrus specializes in practical security assessments and infrastructure hardening for SMBs. Our team can help you identify vulnerable systems, implement secure CI/CD practices, and establish ongoing vulnerability management processes. Contact us to discuss your security needs.