CISA Warned of JetBrains TeamCity Exploitation Risks
The agency identified an unauthenticated remote code execution flaw that allows attackers to compromise CI/CD pipelines.
Updated on Sept. 24, 2026 in Cybersecurity
Live Poll
Do you feel confident that the software used by your employer is adequately protected from cyberattacks?
The Cybersecurity and Infrastructure Security Agency has issued a warning regarding a critical remote code execution vulnerability in JetBrains TeamCity. Attackers are currently exploiting the flaw, which allows for unauthenticated access to build servers.
Why it matters
Build servers act as central chokepoints in the CI/CD pipeline, making them high-value targets for attackers seeking to inject malicious code into production. Compromising these servers grants access to signing keys and cloud credentials used in downstream infrastructure.
The vulnerability is tracked as CWE-502 and carries a critical CVSS score of 9.8. This flaw allows attackers with network access to execute code on the server without authentication, surpassing the security posture of previous unpatched builds.
The players
Cybersecurity and Infrastructure Security Agency
A component of the United States Department of Homeland Security responsible for coordinating national defense against cyber threats.
JetBrains
A software development firm known for its IDEs and TeamCity, a continuous integration and deployment server.
The details
The vulnerability enables unauthenticated remote code execution via the agent polling protocol. By exploiting this, attackers gain control of the TeamCity server to manipulate legitimate build processes. This mechanism facilitates the injection of malicious code while granting the actor access to sensitive cloud credentials and software signing keys.
Timeline
September 23, 2026: CISA issued the official security warning regarding the TeamCity exploit.
The Tech Race
This disclosure follows the agency's established pattern of targeting supply chain vulnerabilities within the CISA Known Exploited Vulnerabilities Catalog. The focus highlights the accelerating competition between automated build security and the increasing sophistication of CI/CD-based ransomware.
Organizations utilizing TeamCity must audit their build servers to ensure they are not exposed to the agent polling protocol on public networks. This vulnerability necessitates immediate patch application to prevent unauthorized code injection into development workflows.
The takeaway
The incident underscores the risk of treating internal CI/CD tooling as secondary to production infrastructure. Network administrators should monitor for unauthorized polling requests and verify the integrity of recent build signatures against known deployment baselines.
Further reading
For broader trends in enterprise defense, visit the Cybersecurity section.
Source note: This article includes information reported by SC Media.
Live Poll
Do you feel confident that the software used by your employer is adequately protected from cyberattacks?
