In CISA KEV9.8 CriticalCWE-502
CVE-2026-63077
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
JetBrainsTeamCity
Status
- Exploited in the wild
- In CISA KEV since 5 Aug
- Fixed in version 2026.1.3
Federal deadlineSat 8 Aug, 23:59 UTC
Passed 78 days ago
CISA KEV · added 5 Aug
Exploit probabilityEPSSchecked 25 Oct
94%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage 19 articles · 6 outlets
See the full timelineShow as table
- Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel AttacksThe Hacker News · mentions it in passing
- JetBrains Urges Cadence Users to Rotate Credentials After BreachThe Hacker News
- JetBrains breach leaks AWS keys via unpatched TeamCity flawSecurityOnline
- CVE-2026-63077 lets attackers hijack JetBrains TeamCity serversSecurityOnline
- CVE-2026-63077 Flaw Lets Attackers Hijack JetBrains TeamCitySecurityOnline
- Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)Rapid7
- Model Kimi K3 Escapes Sandbox, Reaches GitHub via CVE-2026-63077SecurityOnline
- CVE-2026-63077: XCSSET malware targets macOS devs via XcodeSecurityOnline
- CISA puts TeamCity CVE-2026-63077 in KEV, mandates fix by AugustSecurity Affairs
- CISA warns of active TeamCity RCE flaw CVE-2026-63077The Hacker News
- Apple iCloud Private Relay bug leaks IP via WebKit CVE-2026-63077SecurityOnline
- JetBrains patches TeamCity deserialization flaw after CISA alertSecurityWeek
- CISA adds TeamCity RCE flaw CVE-2026-63077 to KEV, patch by Aug 8SecurityOnline
- CISA adds JetBrains TeamCity RCE bug CVE-2026-63077 to KEV listCISA · official notice
- CISA flags critical JetBrains TeamCity flaw CVE‑2026‑63077 in KEVCISA · official notice
- Critical Code Execution Vulnerability Patched in TeamCitySecurityWeek
- Serious JetBrains TeamCity Flaw Lets Attackers Run Code RemotelyRapid7
- TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command ExecutionSecurityOnline
- JetBrains patches critical unauthenticated code flaw in TeamCitySecurity Affairs · first in our coverage