A serious security flaw in a widely used software development tool called TeamCity is being actively exploited by attackers right now, according to the US Cybersecurity and Infrastructure Security Agency (CISA).
- What it is: The vulnerability (CVE-2026-63077) allows an attacker to remotely run malicious code on a vulnerable TeamCity server without needing to log in.
- Who is affected: Businesses or development teams running TeamCity On-Premises to build and deploy their own software. If you outsource software development, ask your provider whether they use TeamCity.
- What the risk is: TeamCity servers often sit at the centre of a software build pipeline, so a compromise can let attackers tamper with code before it reaches customers, or use the server as a foothold into the wider network.
- What action is needed: CISA has set an 8 August 2026 deadline for US federal agencies to patch, which signals how seriously this is being treated. Any organisation running TeamCity On-Premises should update to the latest patched version immediately.
If you are unsure whether this affects your business or your software supply chain, we recommend checking with your IT provider or software vendor without delay.