Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

JetBrains patches TeamCity deserialization flaw after CISA alert

Part of the CVE-2026-63077 story · since 28 Jul

Quiet for 6 weekslast report 28 Sep19 articles6 outlets
28 Jul · Security Affairs first20 Sep8 OctNowThis article8th of 19
  • Tue 28 Jul, 11:51 UTC. Security Affairs, first report. JetBrains patches critical unauthenticated code flaw in TeamCity. Cites a CVE in CISA KEV.
  • Tue 28 Jul, 15:51 UTC. SecurityOnline, its first report on the story. TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 17:31 UTC. Rapid7, its first report on the story. Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely. Cites a CVE in CISA KEV.
  • Fri 31 Jul, 07:26 UTC. SecurityWeek, its first report on the story. Critical Code Execution Vulnerability Patched in TeamCity. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 18:31 UTC. CISA, its first report on the story. CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 19:23 UTC. CISA. CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV list. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 03:21 UTC. SecurityOnline. CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 8. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 06:41 UTC. SecurityWeek. JetBrains patches TeamCity deserialization flaw after CISA alert. Cites a CVE in CISA KEV. This article, 8th of 19.
  • Thu 6 Aug, 06:42 UTC. SecurityOnline. Apple iCloud Private Relay bug leaks IP via WebKit CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:02 UTC. The Hacker News, its first report on the story. CISA warns of active TeamCity RCE flaw CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:32 UTC. Security Affairs. CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by August. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 10:11 UTC. SecurityOnline. CVE-2026-63077: XCSSET malware targets macOS devs via Xcode. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 03:41 UTC. SecurityOnline. Model Kimi K3 Escapes Sandbox, Reaches GitHub via CVE-2026-63077. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 18:52 UTC. Rapid7. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077). Cites a CVE in CISA KEV.
  • Mon 10 Aug, 02:29 UTC. SecurityOnline. CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCity. Cites a CVE in CISA KEV.
  • Mon 24 Aug, 07:51 UTC. SecurityOnline. CVE-2026-63077 lets attackers hijack JetBrains TeamCity servers. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 04:11 UTC. SecurityOnline. JetBrains breach leaks AWS keys via unpatched TeamCity flaw. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 17:01 UTC. The Hacker News. JetBrains Urges Cadence Users to Rotate Credentials After Breach. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.

Threat actors are exploiting a recently patched vulnerability in JetBrains TeamCity, a critical CI/CD platform. The vulnerability, tracked as CVE-2026-63077 with a CVSS score of 9.8, is related to deserialization of untrusted data, allowing unauthenticated attackers to achieve remote code execution via HTTP/S requests. This issue affects all TeamCity On-Premises versions, enabling attackers to bypass authentication checks and execute arbitrary commands with the TeamCity server's privileges.

JetBrains has urged organizations to apply patches included in versions 2025.11.7 and 2026.1.3. The U.S. cybersecurity agency CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, advising federal agencies to patch it within three days. Currently, no active exploitation has been reported.

How the story developed

All 19 articles
Quiet for 6 weekslast report 28 Sep19 articles6 outlets

19 articles from 6 outlets since 28 Jul. Quiet since 28 Sep. This was the 8th report, 9 days after the first.

Now28 Jul5812162025303628First reportSecurity Affairs · 28 Jul, 11:51This article8th of 19 · day 9
  • Tue 28 Jul, 11:51 UTC. Security Affairs, first report. JetBrains patches critical unauthenticated code flaw in TeamCity. Cites a CVE in CISA KEV.
  • Tue 28 Jul, 15:51 UTC. SecurityOnline, its first report on the story. TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 17:31 UTC. Rapid7, its first report on the story. Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely. Cites a CVE in CISA KEV.
  • Fri 31 Jul, 07:26 UTC. SecurityWeek, its first report on the story. Critical Code Execution Vulnerability Patched in TeamCity. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 18:31 UTC. CISA, its first report on the story. CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 19:23 UTC. CISA. CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV list. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 03:21 UTC. SecurityOnline. CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 8. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 06:41 UTC. SecurityWeek. JetBrains patches TeamCity deserialization flaw after CISA alert. Cites a CVE in CISA KEV. This article, 8th of 19.
  • Thu 6 Aug, 06:42 UTC. SecurityOnline. Apple iCloud Private Relay bug leaks IP via WebKit CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:02 UTC. The Hacker News, its first report on the story. CISA warns of active TeamCity RCE flaw CVE-2026-63077. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 09:32 UTC. Security Affairs. CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by August. Cites a CVE in CISA KEV.
  • Thu 6 Aug, 10:11 UTC. SecurityOnline. CVE-2026-63077: XCSSET malware targets macOS devs via Xcode. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 03:41 UTC. SecurityOnline. Model Kimi K3 Escapes Sandbox, Reaches GitHub via CVE-2026-63077. Cites a CVE in CISA KEV.
  • Fri 7 Aug, 18:52 UTC. Rapid7. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077). Cites a CVE in CISA KEV.
  • Mon 10 Aug, 02:29 UTC. SecurityOnline. CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCity. Cites a CVE in CISA KEV.
  • Mon 24 Aug, 07:51 UTC. SecurityOnline. CVE-2026-63077 lets attackers hijack JetBrains TeamCity servers. Cites a CVE in CISA KEV.
  • Mon 31 Aug, 04:11 UTC. SecurityOnline. JetBrains breach leaks AWS keys via unpatched TeamCity flaw. Cites a CVE in CISA KEV.
  • Sat 5 Sep, 17:01 UTC. The Hacker News. JetBrains Urges Cadence Users to Rotate Credentials After Breach. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 19 articles as a list
  1. Tue 28 JulDay 02
    1. JetBrains patches critical unauthenticated code flaw in TeamCity11:51 · Security Affairs · First report · Exploited CVE · Known exploited CVE
    2. TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution15:51 · SecurityOnline · Known exploited CVE
  2. Wed 29 JulDay 11
    1. Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotely17:31 · Rapid7 · Known exploited CVE

  3. Quiet for 2 days

    Fri 31 JulDay 31
    1. Critical Code Execution Vulnerability Patched in TeamCity07:26 · SecurityWeek · Known exploited CVE

  4. Quiet for 5 days

    Wed 5 AugDay 82
    1. CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEV18:31 · CISA · official · CISA alert · Picked up again · Known exploited CVE
    2. CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV list19:23 · CISA · official · Known exploited CVE
  5. Thu 6 AugDay 96
    1. CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 803:21 · SecurityOnline · Known exploited CVE
    2. JetBrains patches TeamCity deserialization flaw after CISA alert06:41 · SecurityWeek · Known exploited CVE · This article, 8th of 19
    3. Apple iCloud Private Relay bug leaks IP via WebKit CVE-2026-6307706:42 · SecurityOnline · Known exploited CVE
    Show 3 more from 6 Aug
    1. CISA warns of active TeamCity RCE flaw CVE-2026-6307709:02 · The Hacker News · Known exploited CVE
    2. CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by August09:32 · Security Affairs · Known exploited CVE
    3. CVE-2026-63077: XCSSET malware targets macOS devs via Xcode10:11 · SecurityOnline · Known exploited CVE
  6. Fri 7 AugDay 102
    1. Model Kimi K3 Escapes Sandbox, Reaches GitHub via CVE-2026-6307703:41 · SecurityOnline · Known exploited CVE
    2. Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)18:52 · Rapid7 · Known exploited CVE

  7. Quiet for 2 days

    Mon 10 AugDay 131
    1. CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCity02:29 · SecurityOnline · Picked up again · Known exploited CVE

  8. Quiet for 2 weeks

    Mon 24 AugDay 271
    1. CVE-2026-63077 lets attackers hijack JetBrains TeamCity servers07:51 · SecurityOnline · Picked up again · Known exploited CVE

  9. Quiet for 7 days

    Mon 31 AugDay 341
    1. JetBrains breach leaks AWS keys via unpatched TeamCity flaw04:11 · SecurityOnline · Picked up again · Known exploited CVE

  10. Quiet for 6 days

    Sat 5 SepDay 391
    1. JetBrains Urges Cadence Users to Rotate Credentials After Breach17:01 · The Hacker News · Picked up again · Known exploited CVE

  11. Quiet for 3 weeks

    Mon 28 SepDay 621
    1. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks14:30 · The Hacker News · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in