Federal cybersecurity regulators are actively tracking compliance remediation windows following the addition of a critical continuous integration server vulnerability to the Known Exploited Vulnerabilities catalog. The flaw permits remote unauthenticated network actors to execute arbitrary operating system commands across build infrastructure.
The vulnerability, tracked as CVE-2026-63077 with a CVSS score of 9.8, impacts JetBrains TeamCity On-Premises builds prior to versions 2025.11.7 and 2026.1.3. The defect involves an untrusted data deserialization bug within the agent polling protocol handler over HTTP and HTTPS. Attackers transmit malformed polling requests to bypass authentication handlers and execute shell commands with build server privileges. CISA has mandated accelerated remediation across federal networks under Binding Operational Directive 26-04 requirements.
Compromising build automation servers creates severe software supply chain exposure across enterprise development pipelines. Armed with administrative control over build nodes, threat actors can alter application source code, inject covert backdoors into production software updates, and steal cloud infrastructure deployment keys.
– Upgrade TeamCity On-Premises instances to patched versions 2025.11.7 or 2026.1.3 immediately, or install the security patch plugin.
– Isolate build management portals behind authenticated zero trust access gateways that restrict public internet exposure.
– Review build agent execution telemetry for unexpected process spawns or unauthorized user account creations.
– Rotate all production deployment credentials, repository access tokens, and signing certificates stored in build variables.
Continuous integration build plane resilience depends on immediate patch deployment and rigid interface isolation to ensure central development servers remain completely protected from unauthenticated exploitation. #CodeDefence #JetBrains #TeamCity #RCE #Deserialization #DevSecOps #SupplyChain #CISA #KEV
/
