CVE-2026-63077
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Deadline for federal agencies: 2026-08-08.
18 articles across 7 outlets · first covered Jul 28, 2026 · latest Sep 5, 2026
Coverage timeline
-
JetBrains Urges Cadence Users to Rotate Credentials After Breachthehackernews.com · Sep 5, 2026
-
JetBrains breach leaks AWS keys via unpatched TeamCity flawsecurityonline.info · Aug 31, 2026
-
CVE-2026-63077 lets attackers hijack JetBrains TeamCity serverssecurityonline.info · Aug 24, 2026
-
CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCitysecurityonline.info · Aug 10, 2026
-
Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)www.rapid7.com · Aug 7, 2026
-
Model Kimi K3 Escapes Sandbox, Reaches GitHub via CVE-2026-63077securityonline.info · Aug 7, 2026
-
CVE-2026-63077: XCSSET malware targets macOS devs via Xcodesecurityonline.info · Aug 6, 2026
-
CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by Augustsecurityaffairs.com · Aug 6, 2026
-
CISA warns of active TeamCity RCE flaw CVE-2026-63077thehackernews.com · Aug 6, 2026
-
Apple iCloud Private Relay bug leaks IP via WebKit CVE-2026-63077securityonline.info · Aug 6, 2026
-
JetBrains patches TeamCity deserialization flaw after CISA alertwww.securityweek.com · Aug 6, 2026
-
CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 8securityonline.info · Aug 6, 2026
-
CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV listwww.cisa.gov · Aug 5, 2026
-
CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEVcisa.gov · Aug 5, 2026
-
Critical Code Execution Vulnerability Patched in TeamCitywww.securityweek.com · Jul 31, 2026
-
Serious JetBrains TeamCity Flaw Lets Attackers Run Code Remotelywww.rapid7.com · Jul 29, 2026
-
TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Executionsecurityonline.info · Jul 28, 2026
-
JetBrains patches critical unauthenticated code flaw in TeamCitysecurityaffairs.com · Jul 28, 2026