Loading story…
CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, raising the total number of listed flaws from 1660 to 1661. The vulnerability affects JetBrains TeamCity and is described as a deserialization of untrusted data issue that could allow unauthenticated remote code execution through the TeamCity agent polling protocol. CISA mapped the flaw to CWE-502, said known ransomware use is currently unknown, and directed organizations to apply vendor mitigations and follow BOD 26-04 and forensic triage guidance.
Public defender activity followed quickly, with a Nuclei template pull request opened for CVE-2026-63077 covering TeamCity versions earlier than 2026.1.3 and 2025.11.7. The repository activity showed the detection template moving through review and merge workflow, indicating that scanning coverage for the newly cataloged, exploited TeamCity flaw was being prepared as organizations faced a CISA remediation due date of 2026-08-08.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
CISA updated its Known Exploited Vulnerabilities catalog on 2026-08-05 and added CVE-2026-63077, a JetBrains TeamCity deserialization of untrusted data vulnerability. The entry says the flaw could allow unauthenticated remote code execution via the TeamCity agent polling protocol.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **CVE-2026-63077** to its Known Exploited Vulnerabilities catalog after attackers began exploiting a critical JetBrains TeamCity On-Premises flaw that enables **unauthenticated remote code execution**. The vulnerability stems from deserialization of untrusted data in the TeamCity agent polling protocol and can be triggered over HTTP or HTTPS, allowing attackers to bypass authentication and execute operating system commands on exposed servers. JetBrains said all TeamCity On-Premises versions were affected until fixes shipped in **2025.11.7** and **2026.1.3**, and also released a security patch plugin for versions **2017.1 and later** as a temporary mitigation path. Under **BOD 26-04**, CISA ordered federal civilian agencies to remediate by **2026-08-08**. A successful compromise of TeamCity can expose source code, secrets, signing material, and deployment connections, raising the risk of broader software supply-chain compromise.
Aug 7, 2026
JetBrains disclosed **CVE-2026-63077**, a critical remote code execution flaw in TeamCity On-Premises that lets unauthenticated attackers with HTTP(S) access abuse the agent polling protocol to bypass authentication and run arbitrary operating system commands. The vulnerability affects TeamCity versions before **2026.1.3** and **2025.11.7**, carries a CVSS 3.1 rating of **9.8** (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`), and is mapped to **CWE-502**. JetBrains released fixes in **2025.11.7** and **2026.1.3**, and also published a security patch plugin for TeamCity versions **2017.1 and later** for organizations that cannot upgrade immediately. TeamCity Cloud instances were already updated, while JetBrains said it has **no evidence of active exploitation**; CISA’s SSVC assessment likewise indicates no known exploitation but notes the bug is **automatable** and could have **total technical impact**. Successful attacks could expose TeamCity data, configurations, and stored credentials, or allow modification of server state depending on the privileges of the TeamCity process.
Aug 25, 2026
ProjectDiscovery added a Nuclei template for **CVE-2024-27198**, an authentication bypass affecting **JetBrains TeamCity** versions earlier than `2023.11.4`. The template is intended to help defenders identify exposed TeamCity servers vulnerable to unauthorized access, a flaw that drew broad attention because it can allow attackers to reach administrative functionality without valid credentials. The related references also show ongoing community work to operationalize and remediate disclosed vulnerabilities across the ecosystem, including a GitHub pull request to fix a **path traversal** issue in BeehiveInnovations' `pal-mcp-server`, a Nuclei template contribution for **CVE-2023-40044**, and Google security research updates for **kernelCTF CVE-2024-50264**. Together, the activity reflects active publication of detection content, exploit research, and code fixes for high-impact flaws spanning enterprise software, open-source applications, and the Linux kernel.
Jul 12, 2026