If you run JetBrains TeamCity or similar CI/CD servers, there’s a critical vulnerability being exploited in active deployments. Here’s what you need to know and practical steps to protect your pipelines.
What happened
Security researchers have observed active exploitation of CVE-2026-63077 in JetBrains TeamCity. The flaw can lead to remote code execution without authentication in certain configurations. JetBrains has released a patched version and guidance for mitigation. Details are evolving as more environments are observed and reported by security teams. For authoritative guidance, see the JetBrains advisory JetBrains TeamCity Security Advisory.
Why it matters
CI/CD servers sit at the core of software delivery. If attackers compromise TeamCity, they could push malicious code, exfiltrate secrets, or pivot to other services. That risk is especially real for small teams, developers, and creators who rely on automated pipelines in both cloud and on-prem setups.
What you can do now
- Identify whether you’re running TeamCity and check your version against the advisory. Upgrade to the patched release as soon as possible.
- Limit exposure: keep TeamCity behind a VPN or SSO, disable unnecessary internet exposure, and enforce MFA for access to the CI server.
- Review credentials and secrets used by build agents. Rotate credentials and rotate any secrets stored in build steps or plugins.
- Monitor logs for signs of compromise: new administrator accounts, unusual build steps, or unexpected plugin updates.
- Test patches in a staging environment before applying them to production. Ensure reliable backups and a plan to roll back if needed.
- Enhance defense in depth: firewalling or WAF in front of CI/CD endpoints, network segmentation, and strict access controls for agents and repositories.
- Document an incident response plan and consider enabling automatic security scanning for CI components where available.
Final thoughts
Staying proactive with CI/CD security helps protect your code, your customers, and your team’s productivity. Patch early, monitor actively, and share what you’re doing to secure pipelines so others can learn from your approach.