Skip to content
OriginalSign in

CISA KEV alertCyberSIXT

CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV

Part of the CVE-2026-63077 story · since 28 Jul

Quiet for 6 weekslast report 28 Sep19 articles6 outlets
28 Jul · Security Affairs first20 Sep8 OctNowThis article5th of 19
  • Tue 28 Jul, 11:51 UTC. Security Affairs, first report. JetBrains patches critical unauthenticated code flaw in TeamCity. Cites a CVE in CISA KEV.
  • Tue 28 Jul, 15:51 UTC. SecurityOnline, its first report on the story. TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 17:31 UTC. Rapid7, its first report on the story. Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely. Cites a CVE in CISA KEV.
  • Fri 31 Jul, 07:26 UTC. SecurityWeek, its first report on the story. Critical Code Execution Vulnerability Patched in TeamCity. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 18:31 UTC. CISA, its first report on the story. CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV. Cites a CVE in CISA KEV. This article, 5th of 19.
  • Wed 5 Aug, 19:23 UTC. CISA. CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV list. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 03:21 UTC. SecurityOnline. CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 8. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 06:41 UTC. SecurityWeek. JetBrains patches TeamCity deserialization flaw after CISA alert. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 06:42 UTC. SecurityOnline. Apple iCloud Private Relay bug leaks IP via WebKit CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:02 UTC. The Hacker News, its first report on the story. CISA warns of active TeamCity RCE flaw CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:32 UTC. Security Affairs. CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by August. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 10:11 UTC. SecurityOnline. CVE-2026-63077: XCSSET malware targets macOS devs via Xcode. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 03:41 UTC. SecurityOnline. Model Kimi K3 Escapes Sandbox, Reaches GitHub via CVE-2026-63077. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 18:52 UTC. Rapid7. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077). Cites a CVE in CISA KEV.
  • Mon 10 Aug, 02:29 UTC. SecurityOnline. CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCity. Cites a CVE in CISA KEV.
  • Mon 24 Aug, 07:51 UTC. SecurityOnline. CVE-2026-63077 lets attackers hijack JetBrains TeamCity servers. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 04:11 UTC. SecurityOnline. JetBrains breach leaks AWS keys via unpatched TeamCity flaw. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 17:01 UTC. The Hacker News. JetBrains Urges Cadence Users to Rotate Credentials After Breach. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.

On 5 August 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑63077 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects JetBrains TeamCity and is named the JetBrains TeamCity Deserialization of Untrusted Data Vulnerability. It allows unauthenticated remote code execution via the agent polling protocol.

The vulnerability is a deserialization of untrusted data issue in TeamCity’s agent polling interface. An attacker who can send crafted data to the protocol can achieve arbitrary code execution on the server without authentication. The Common Vulnerability Scoring System assigns it a base score of 9.8, rating it as critical. No patch or advisory has been made public at the time of writing, and the patch status is listed as unknown.

CISA’s inclusion in the KEV catalogue confirms that the vulnerability is being actively exploited in the wild. There is no publicly known link to ransomware campaigns at this time. Federal Civilian Executive Branch (FCEB) agencies must apply mitigations by the remediation due date of 8 August 2026.

CISA directs FCEB agencies to apply mitigations in accordance with JetBrains guidance, ensure compliance with BOD 26‑04 Prioritizing Security Updates Based on Risk and the Forensics Triage Requirements, follow applicable BOD 26‑04 guidance for cloud services or discontinue use of the product if mitigations are unavailable, and evaluate each asset's internet exposure to adhere to BOD 26‑04 patching guidelines. All other organisations should review their TeamCity deployments for exposure and apply any available mitigations.

For full details, see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-63077 and the CISA KEV catalogue.

How the story developed

All 19 articles
Quiet for 6 weekslast report 28 Sep19 articles6 outlets

19 articles from 6 outlets since 28 Jul. Quiet since 28 Sep. This was the 5th report, 8 days after the first.

Now28 Jul5812162025303628First reportSecurity Affairs · 28 Jul, 11:51This article5th of 19 · day 8
  • Tue 28 Jul, 11:51 UTC. Security Affairs, first report. JetBrains patches critical unauthenticated code flaw in TeamCity. Cites a CVE in CISA KEV.
  • Tue 28 Jul, 15:51 UTC. SecurityOnline, its first report on the story. TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 17:31 UTC. Rapid7, its first report on the story. Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely. Cites a CVE in CISA KEV.
  • Fri 31 Jul, 07:26 UTC. SecurityWeek, its first report on the story. Critical Code Execution Vulnerability Patched in TeamCity. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 18:31 UTC. CISA, its first report on the story. CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV. Cites a CVE in CISA KEV. This article, 5th of 19.
  • Wed 5 Aug, 19:23 UTC. CISA. CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV list. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 03:21 UTC. SecurityOnline. CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 8. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 06:41 UTC. SecurityWeek. JetBrains patches TeamCity deserialization flaw after CISA alert. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 06:42 UTC. SecurityOnline. Apple iCloud Private Relay bug leaks IP via WebKit CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:02 UTC. The Hacker News, its first report on the story. CISA warns of active TeamCity RCE flaw CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:32 UTC. Security Affairs. CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by August. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 10:11 UTC. SecurityOnline. CVE-2026-63077: XCSSET malware targets macOS devs via Xcode. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 03:41 UTC. SecurityOnline. Model Kimi K3 Escapes Sandbox, Reaches GitHub via CVE-2026-63077. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 18:52 UTC. Rapid7. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077). Cites a CVE in CISA KEV.
  • Mon 10 Aug, 02:29 UTC. SecurityOnline. CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCity. Cites a CVE in CISA KEV.
  • Mon 24 Aug, 07:51 UTC. SecurityOnline. CVE-2026-63077 lets attackers hijack JetBrains TeamCity servers. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 04:11 UTC. SecurityOnline. JetBrains breach leaks AWS keys via unpatched TeamCity flaw. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 17:01 UTC. The Hacker News. JetBrains Urges Cadence Users to Rotate Credentials After Breach. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 19 articles as a list
  1. Tue 28 JulDay 02
    1. JetBrains patches critical unauthenticated code flaw in TeamCity11:51 · Security Affairs · First report · Exploited CVE · Known exploited CVE
    2. TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution15:51 · SecurityOnline · Known exploited CVE
  2. Wed 29 JulDay 11
    1. Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely17:31 · Rapid7 · Known exploited CVE

  3. Quiet for 2 days

    Fri 31 JulDay 31
    1. Critical Code Execution Vulnerability Patched in TeamCity07:26 · SecurityWeek · Known exploited CVE

  4. Quiet for 5 days

    Wed 5 AugDay 82
    1. CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV18:31 · CISA · official · CISA alert · Picked up again · Known exploited CVE · This article, 5th of 19
    2. CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV list19:23 · CISA · official · Known exploited CVE
  5. Thu 6 AugDay 96
    1. CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 803:21 · SecurityOnline · Known exploited CVE
    2. JetBrains patches TeamCity deserialization flaw after CISA alert06:41 · SecurityWeek · Known exploited CVE
    3. Apple iCloud Private Relay bug leaks IP via WebKit CVE-2026-6307706:42 · SecurityOnline · Known exploited CVE
    Show 3 more from 6 Aug
    1. CISA warns of active TeamCity RCE flaw CVE-2026-6307709:02 · The Hacker News · Known exploited CVE
    2. CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by August09:32 · Security Affairs · Known exploited CVE
    3. CVE-2026-63077: XCSSET malware targets macOS devs via Xcode10:11 · SecurityOnline · Known exploited CVE
  6. Fri 7 AugDay 102
    1. Model Kimi K3 Escapes Sandbox, Reaches GitHub via CVE-2026-6307703:41 · SecurityOnline · Known exploited CVE
    2. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)18:52 · Rapid7 · Known exploited CVE

  7. Quiet for 2 days

    Mon 10 AugDay 131
    1. CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCity02:29 · SecurityOnline · Picked up again · Known exploited CVE

  8. Quiet for 2 weeks

    Mon 24 AugDay 271
    1. CVE-2026-63077 lets attackers hijack JetBrains TeamCity servers07:51 · SecurityOnline · Picked up again · Known exploited CVE

  9. Quiet for 7 days

    Mon 31 AugDay 341
    1. JetBrains breach leaks AWS keys via unpatched TeamCity flaw04:11 · SecurityOnline · Picked up again · Known exploited CVE

  10. Quiet for 6 days

    Sat 5 SepDay 391
    1. JetBrains Urges Cadence Users to Rotate Credentials After Breach17:01 · The Hacker News · Picked up again · Known exploited CVE

  11. Quiet for 3 weeks

    Mon 28 SepDay 621
    1. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks14:30 · The Hacker News · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in