Column 1
Skip to content

TeamCity CVE-2026-63077: CISA KEV Patch Guide for On-Premises Servers

August 6, 2026

CISA has added JetBrains TeamCity CVE-2026-63077 to its Known Exploited Vulnerabilities Catalog. Treat this as a priority maintenance item for every TeamCity On-Premises server. JetBrains says all on-premises versions are affected and has released corrected versions for the current supported lines.

What needs attention

The issue affects TeamCity On-Premises, not TeamCity Cloud. A compromised build server can put deployment credentials, build artifacts, source integrations, and downstream infrastructure at risk. Do not treat a CI/CD server as ordinary application infrastructure: it often has broad access by design.

Patch path

  1. Identify every self-managed TeamCity server, including standby and disaster-recovery instances.
  2. Plan a short build window, confirm recovery readiness, and notify teams with active release pipelines.
  3. Update to JetBrains TeamCity 2025.11.7 or 2026.1.3, or move to a newer vendor-supported release.
  4. For older supported installations that cannot be upgraded immediately, use JetBrains’ documented security patch option while scheduling the full upgrade.
  5. Verify that administrators can sign in, a controlled build completes, expected artifacts are available, and integrations behave normally.

Reduce exposure while maintenance is underway

  • Restrict administrative access to trusted operators and approved networks.
  • Pause nonessential release activity until the corrected version is confirmed.
  • Review recent administrator changes, build configuration changes, agent registrations, and unexpected process activity.
  • Review credentials available to the build service. Rotate or reissue high-value secrets if your investigation finds signs of unauthorized access.

Hosting and WordPress deployment teams

Hosting teams should treat TeamCity maintenance as a control-plane change: protect the backup and recovery path, sequence agents and build workloads deliberately, and keep a written record of the version and post-change checks. Teams that deploy WordPress through CI/CD should also use the WordPress support hub to verify maintenance behavior, cache state, and production availability after a release.

For related fleet-response planning, see our N-central hotfix guide and our Proxmox operations hub.

Sources