Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability

Hackers have begun actively exploiting a critical vulnerability in JetBrains TeamCity tracked as CVE-2026-63077. SecurityWeek reports that the bug can be exploited without authentication and leads to remote code execution. That combination makes unpatched TeamCity instances immediate targets rather than theoretical risks.

CVE-2026-63077 is critical because it removes the usual first barrier of authentication. An unauthenticated attacker who can reach a vulnerable TeamCity server can attempt remote code execution on the host that runs the continuous integration service. TeamCity sits on the path between source repositories, build agents, secrets, and deployment pipelines, so a successful exploit lands an attacker inside the software delivery control plane rather than on a peripheral app server.

For engineers and builders, this is a CI/CD security incident first and a product bug second. TeamCity often holds credentials for package registries, cloud accounts, signing keys, and production deploy targets. Unauthenticated remote code execution on that host can turn a single exposed instance into a path for supply-chain compromise, credential theft, or malicious build injection across projects that share the same server.

In the competitive CI market, JetBrains TeamCity is widely used in organizations that prefer self-hosted build infrastructure. Self-hosting gives control over agents and networks but also leaves internet-facing or poorly segmented servers as attractive targets once a critical unauthenticated RCE is public and under active exploitation. Attackers consistently prioritize CI platforms for the same reason defenders do: one compromised build system can affect many downstream systems.

Practical next steps are straightforward. Inventory every TeamCity instance, confirm whether it is reachable without strong network controls, and apply JetBrains guidance for CVE-2026-63077 without delay. Restrict management interfaces to trusted networks or VPN access, rotate any secrets that lived on exposed servers, and review recent build history and agent activity for signs of unauthorized jobs or unexpected outbound connections.

Watch for follow-on reporting on exploit volume, whether mass scanning is already underway, and any additional JetBrains advisories or patches tied to the same issue class. Teams that delayed hardening internet-exposed CI should treat this campaign as the forcing function to finish that work now.