CISA Adds JetBrains TeamCity Pre-Auth RCE to Known Exploited Vulnerabilities
Active Exploitation · 2 sources · Updated 3mo ago · First seen Aug 5, 2026
CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, raising the total number of listed flaws from 1660 to 1661. The vulnerability affects JetBrains TeamCity and is described as a deserialization of untrusted data issue that could allow unauthenticated remote code execution through the TeamCity agent polling protocol. CISA mapped the flaw to CWE-502, said known ransomware use is currently unknown, and directed organizations to apply vendor mitigations and follow BOD 26-04 and forensic triage guidance.
Public defender activity followed quickly, with a Nuclei template pull request opened for CVE-2026-63077 covering TeamCity versions earlier than 2026.1.3 and 2025.11.7. The repository activity showed the detection template moving through review and merge workflow, indicating that scanning coverage for the newly cataloged, exploited TeamCity flaw was being prepared as organizations faced a CISA remediation due date of 2026-08-08.
