Skip to content
OriginalSign in
Image: Rapid7

Rapid7Rapid7

Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely

Part of the CVE-2026-63077 story · since 28 Jul

Quiet for 5 weekslast report 28 Sep19 articles6 outlets
28 Jul · Security Affairs first14 Sep30 Sep16 OctNowThis article3rd of 19
  • Tue 28 Jul, 11:51 UTC. Security Affairs, first report. JetBrains patches critical unauthenticated code flaw in TeamCity. Cites a CVE in CISA KEV.
  • Tue 28 Jul, 15:51 UTC. SecurityOnline, its first report on the story. TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 17:31 UTC. Rapid7, its first report on the story. Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely. Cites a CVE in CISA KEV. This article, 3rd of 19.
  • Fri 31 Jul, 07:26 UTC. SecurityWeek, its first report on the story. Critical Code Execution Vulnerability Patched in TeamCity. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 18:31 UTC. CISA, its first report on the story. CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 19:23 UTC. CISA. CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV list. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 03:21 UTC. SecurityOnline. CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 8. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 06:41 UTC. SecurityWeek. JetBrains patches TeamCity deserialization flaw after CISA alert. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 06:42 UTC. SecurityOnline. Apple iCloud Private Relay bug leaks IP via WebKit CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:02 UTC. The Hacker News, its first report on the story. CISA warns of active TeamCity RCE flaw CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:32 UTC. Security Affairs. CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by August. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 10:11 UTC. SecurityOnline. CVE-2026-63077: XCSSET malware targets macOS devs via Xcode. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 03:41 UTC. SecurityOnline. Model Kimi K3 Escapes Sandbox, Reaches GitHub via CVE-2026-63077. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 18:52 UTC. Rapid7. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077). Cites a CVE in CISA KEV.
  • Mon 10 Aug, 02:29 UTC. SecurityOnline. CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCity. Cites a CVE in CISA KEV.
  • Mon 24 Aug, 07:51 UTC. SecurityOnline. CVE-2026-63077 lets attackers hijack JetBrains TeamCity servers. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 04:11 UTC. SecurityOnline. JetBrains breach leaks AWS keys via unpatched TeamCity flaw. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 17:01 UTC. The Hacker News. JetBrains Urges Cadence Users to Rotate Credentials After Breach. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.

On July 27, 2026, JetBrains announced a critical security vulnerability (CVE-2026-63077) affecting all versions of TeamCity On-Premises, allowing unauthenticated remote code execution. This vulnerability, classified under CVSS with a score of 9.8, enables cyber attackers to bypass authentication and execute commands with the privileges of the TeamCity server process.

JetBrains has advised users to urgently update to fixed versions (2025.11.7 or 2026.1.3) or apply a security patch plugin if upgrading is not possible. Rapid7 customers can assess their exposure to this vulnerability through available vulnerability checks. For further details, organizations are directed to the JetBrains security advisory.

How the story developed

All 19 articles
Quiet for 5 weekslast report 28 Sep19 articles6 outlets

19 articles from 6 outlets since 28 Jul. Quiet since 28 Sep. This was the 3rd report, 1 day after the first.

Now28 Jul6913172125303628First reportSecurity Affairs · 28 Jul, 11:51This article3rd of 19 · day 1
  • Tue 28 Jul, 11:51 UTC. Security Affairs, first report. JetBrains patches critical unauthenticated code flaw in TeamCity. Cites a CVE in CISA KEV.
  • Tue 28 Jul, 15:51 UTC. SecurityOnline, its first report on the story. TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 17:31 UTC. Rapid7, its first report on the story. Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely. Cites a CVE in CISA KEV. This article, 3rd of 19.
  • Fri 31 Jul, 07:26 UTC. SecurityWeek, its first report on the story. Critical Code Execution Vulnerability Patched in TeamCity. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 18:31 UTC. CISA, its first report on the story. CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 19:23 UTC. CISA. CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV list. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 03:21 UTC. SecurityOnline. CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 8. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 06:41 UTC. SecurityWeek. JetBrains patches TeamCity deserialization flaw after CISA alert. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 06:42 UTC. SecurityOnline. Apple iCloud Private Relay bug leaks IP via WebKit CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:02 UTC. The Hacker News, its first report on the story. CISA warns of active TeamCity RCE flaw CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:32 UTC. Security Affairs. CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by August. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 10:11 UTC. SecurityOnline. CVE-2026-63077: XCSSET malware targets macOS devs via Xcode. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 03:41 UTC. SecurityOnline. Model Kimi K3 Escapes Sandbox, Reaches GitHub via CVE-2026-63077. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 18:52 UTC. Rapid7. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077). Cites a CVE in CISA KEV.
  • Mon 10 Aug, 02:29 UTC. SecurityOnline. CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCity. Cites a CVE in CISA KEV.
  • Mon 24 Aug, 07:51 UTC. SecurityOnline. CVE-2026-63077 lets attackers hijack JetBrains TeamCity servers. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 04:11 UTC. SecurityOnline. JetBrains breach leaks AWS keys via unpatched TeamCity flaw. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 17:01 UTC. The Hacker News. JetBrains Urges Cadence Users to Rotate Credentials After Breach. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 19 articles as a list
  1. Tue 28 JulDay 02
    1. JetBrains patches critical unauthenticated code flaw in TeamCity11:51 · Security Affairs · First report · Exploited CVE · Known exploited CVE
    2. TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution15:51 · SecurityOnline · Known exploited CVE
  2. Wed 29 JulDay 11
    1. Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely17:31 · Rapid7 · Known exploited CVE · This article, 3rd of 19

  3. Quiet for 2 days

    Fri 31 JulDay 31
    1. Critical Code Execution Vulnerability Patched in TeamCity07:26 · SecurityWeek · Known exploited CVE

  4. Quiet for 5 days

    Wed 5 AugDay 82
    1. CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV18:31 · CISA · official · CISA alert · Picked up again · Known exploited CVE
    2. CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV list19:23 · CISA · official · Known exploited CVE
  5. Thu 6 AugDay 96
    1. CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 803:21 · SecurityOnline · Known exploited CVE
    2. JetBrains patches TeamCity deserialization flaw after CISA alert06:41 · SecurityWeek · Known exploited CVE
    3. Apple iCloud Private Relay bug leaks IP via WebKit CVE-2026-6307706:42 · SecurityOnline · Known exploited CVE
    Show 3 more from 6 Aug
    1. CISA warns of active TeamCity RCE flaw CVE-2026-6307709:02 · The Hacker News · Known exploited CVE
    2. CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by August09:32 · Security Affairs · Known exploited CVE
    3. CVE-2026-63077: XCSSET malware targets macOS devs via Xcode10:11 · SecurityOnline · Known exploited CVE
  6. Fri 7 AugDay 102
    1. Model Kimi K3 Escapes Sandbox, Reaches GitHub via CVE-2026-6307703:41 · SecurityOnline · Known exploited CVE
    2. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)18:52 · Rapid7 · Known exploited CVE

  7. Quiet for 2 days

    Mon 10 AugDay 131
    1. CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCity02:29 · SecurityOnline · Picked up again · Known exploited CVE

  8. Quiet for 2 weeks

    Mon 24 AugDay 271
    1. CVE-2026-63077 lets attackers hijack JetBrains TeamCity servers07:51 · SecurityOnline · Picked up again · Known exploited CVE

  9. Quiet for 7 days

    Mon 31 AugDay 341
    1. JetBrains breach leaks AWS keys via unpatched TeamCity flaw04:11 · SecurityOnline · Picked up again · Known exploited CVE

  10. Quiet for 6 days

    Sat 5 SepDay 391
    1. JetBrains Urges Cadence Users to Rotate Credentials After Breach17:01 · The Hacker News · Picked up again · Known exploited CVE

  11. Quiet for 3 weeks

    Mon 28 SepDay 621
    1. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks14:30 · The Hacker News · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in