Skip to content
OriginalSign in
Image: The Hacker News

The Hacker Newsinfo@thehackernews.com (The Hacker News)

TeamCity flaw lets attackers run OS commands without login

Part of the TeamCity story · since 23 Jul

Quiet for 12 weekslast report 10 Aug15 articles6 outlets
23 Jul · SecurityOnline first12 Sep29 Sep16 OctNowThis article2nd of 15
  • Thu 23 Jul, 16:31 UTC. SecurityOnline, first report. JetBrains Patches 18 Flaws, Including Two CVSS 10 Bugs in IntelliJ IDEA Remote Development.
  • Tue 28 Jul, 09:32 UTC. The Hacker News, its first report on the story. TeamCity flaw lets attackers run OS commands without login. This article, 2nd of 15.
  • Tue 28 Jul, 11:51 UTC. Security Affairs, its first report on the story. JetBrains patches critical unauthenticated code flaw in TeamCity. Cites a CVE in CISA KEV.
  • Tue 28 Jul, 15:51 UTC. SecurityOnline. TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 17:31 UTC. Rapid7, its first report on the story. Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely. Cites a CVE in CISA KEV.
  • Fri 31 Jul, 07:26 UTC. SecurityWeek, its first report on the story. Critical Code Execution Vulnerability Patched in TeamCity. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 18:31 UTC. CISA, its first report on the story. CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 19:23 UTC. CISA. CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV list. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 03:21 UTC. SecurityOnline. CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 8. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 06:41 UTC. SecurityWeek. JetBrains patches TeamCity deserialization flaw after CISA alert. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:02 UTC. The Hacker News. CISA warns of active TeamCity RCE flaw CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:32 UTC. Security Affairs. CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by August. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 18:52 UTC. Rapid7. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077). Cites a CVE in CISA KEV.
  • Mon 10 Aug, 02:29 UTC. SecurityOnline. CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCity. Cites a CVE in CISA KEV.
  • Mon 10 Aug, 06:20 UTC. SecurityOnline. Critical flaws in Nable and TeamCity products under active attack.

A critical vulnerability in TeamCity has been identified, allowing attackers to execute OS commands without needing to log in. This flaw, highlighted by Ravie Lakshmanan on July 28, 2026, poses significant risks to enterprise security and underscores the necessity for organizations to address such vulnerabilities to safeguard their systems.

How the story developed

All 15 articles
Quiet for 12 weekslast report 10 Aug15 articles6 outlets

15 articles from 6 outlets since 23 Jul. Quiet since 10 Aug. This was the 2nd report, 5 days after the first.

Now23 Jul262830246810First reportSecurityOnline · 23 Jul, 16:31This article2nd of 15 · day 5CISA alert5 Aug, 18:31 · official
  • Thu 23 Jul, 16:31 UTC. SecurityOnline, first report. JetBrains Patches 18 Flaws, Including Two CVSS 10 Bugs in IntelliJ IDEA Remote Development.
  • Tue 28 Jul, 09:32 UTC. The Hacker News, its first report on the story. TeamCity flaw lets attackers run OS commands without login. This article, 2nd of 15.
  • Tue 28 Jul, 11:51 UTC. Security Affairs, its first report on the story. JetBrains patches critical unauthenticated code flaw in TeamCity. Cites a CVE in CISA KEV.
  • Tue 28 Jul, 15:51 UTC. SecurityOnline. TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 17:31 UTC. Rapid7, its first report on the story. Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely. Cites a CVE in CISA KEV.
  • Fri 31 Jul, 07:26 UTC. SecurityWeek, its first report on the story. Critical Code Execution Vulnerability Patched in TeamCity. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 18:31 UTC. CISA, its first report on the story. CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 19:23 UTC. CISA. CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV list. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 03:21 UTC. SecurityOnline. CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 8. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 06:41 UTC. SecurityWeek. JetBrains patches TeamCity deserialization flaw after CISA alert. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:02 UTC. The Hacker News. CISA warns of active TeamCity RCE flaw CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:32 UTC. Security Affairs. CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by August. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 18:52 UTC. Rapid7. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077). Cites a CVE in CISA KEV.
  • Mon 10 Aug, 02:29 UTC. SecurityOnline. CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCity. Cites a CVE in CISA KEV.
  • Mon 10 Aug, 06:20 UTC. SecurityOnline. Critical flaws in Nable and TeamCity products under active attack.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 15 articles as a list
  1. Thu 23 JulDay 01
    1. JetBrains Patches 18 Flaws, Including Two CVSS 10 Bugs in IntelliJ IDEA Remote Development16:31 · SecurityOnline · First report

  2. Quiet for 5 days

    Tue 28 JulDay 53
    1. TeamCity flaw lets attackers run OS commands without login09:32 · The Hacker News · Picked up again · This article, 2nd of 15
    2. JetBrains patches critical unauthenticated code flaw in TeamCity11:51 · Security Affairs · Exploited CVE · Known exploited CVE
    3. TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution15:51 · SecurityOnline · Known exploited CVE
  3. Wed 29 JulDay 61
    1. Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely17:31 · Rapid7 · Known exploited CVE

  4. Quiet for 2 days

    Fri 31 JulDay 81
    1. Critical Code Execution Vulnerability Patched in TeamCity07:26 · SecurityWeek · Known exploited CVE

  5. Quiet for 5 days

    Wed 5 AugDay 132
    1. CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV18:31 · CISA · official · CISA alert · Picked up again · Known exploited CVE
    2. CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV list19:23 · CISA · official · Known exploited CVE
  6. Thu 6 AugDay 144
    1. CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 803:21 · SecurityOnline · Known exploited CVE
    2. JetBrains patches TeamCity deserialization flaw after CISA alert06:41 · SecurityWeek · Known exploited CVE
    3. CISA warns of active TeamCity RCE flaw CVE-2026-6307709:02 · The Hacker News · Known exploited CVE
    4. CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by August09:32 · Security Affairs · Known exploited CVE
  7. Fri 7 AugDay 151
    1. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)18:52 · Rapid7 · Known exploited CVE

  8. Quiet for 2 days

    Mon 10 AugDay 182
    1. CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCity02:29 · SecurityOnline · Picked up again · Known exploited CVE
    2. Critical flaws in Nable and TeamCity products under active attack06:20 · SecurityOnline

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in