actively-exploited-vulnerabilitygovernment-vulnerability-cataloginternet-facing-service-vulnerabilitywidely-deployed-product-advisory

CISA Flags Actively Exploited JetBrains TeamCity RCE

Active Exploitation · 6 sources · Updated 3mo ago · First seen Aug 6, 2026

CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog after attackers began exploiting a critical JetBrains TeamCity On-Premises flaw that enables unauthenticated remote code execution. The vulnerability stems from deserialization of untrusted data in the TeamCity agent polling protocol and can be triggered over HTTP or HTTPS, allowing attackers to bypass authentication and execute operating system commands on exposed servers.

JetBrains said all TeamCity On-Premises versions were affected until fixes shipped in 2025.11.7 and 2026.1.3, and also released a security patch plugin for versions 2017.1 and later as a temporary mitigation path. Under BOD 26-04, CISA ordered federal civilian agencies to remediate by 2026-08-08. A successful compromise of TeamCity can expose source code, secrets, signing material, and deployment connections, raising the risk of broader software supply-chain compromise.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Aug 4, 2026 – Aug 7, 2026

Aug 7, 20263mo ago
Rapid7 publishes exploit analysis and IOCs for TeamCity CVE-2026-63077
Rapid7 disclosed technical details for CVE-2026-63077, identifying the root cause as TeamCity failing to clear XStream default permissions before applying its allowlist and describing an unauthenticated exploit chain via the agent polling protocol. The analysis also published indicators of compromise, including TeamCity log errors such as ConversionException, ForbiddenClassException on patched systems, and HSQLDB file I/O errors tied to attacker-written .jspws files.
Rapid7 Analysis of CVE-2026-63077, an unauthenticated Remote Code Execution vulnerability in JetBrains TeamCity
Reported Aug 6, 20263mo ago
CISA confirms active exploitation of TeamCity flaw
CISA warned that threat actors have started exploiting CVE-2026-63077 in JetBrains TeamCity. Public details about the attacks were not provided.
Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability - SecurityWeek
Reported Aug 6, 20263mo ago
JetBrains releases fixes for CVE-2026-63077
JetBrains released patched TeamCity versions 2025.11.7 and 2026.1.3 for CVE-2026-63077, and also provided a security patch plugin for TeamCity 2017.1 and later. The flaw affects TeamCity On-Premises and allows unauthenticated remote code execution via deserialization in the agent polling protocol.
Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability - SecurityWeek
Reported Aug 6, 20263mo ago
JetBrains privately receives report of TeamCity RCE flaw
JetBrains said CVE-2026-63077 in TeamCity had been reported privately. At the time of its advisory, the company said it was not aware of active exploitation.
Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability - SecurityWeek
Aug 5, 20263mo ago
CISA adds TeamCity CVE-2026-63077 to KEV catalog
CISA added CVE-2026-63077, a JetBrains TeamCity deserialization of untrusted data vulnerability, to the Known Exploited Vulnerabilities catalog. The catalog entry describes unauthenticated remote code execution via the TeamCity agent polling protocol and references vendor mitigation guidance.
Add Updated KEV Files for 2026-08-05 · cisagov/kev-data@eebe24a · GitHub
Aug 4, 20263mo ago
CISA adds CVE-2026-9198 to KEV catalog
CISA added CVE-2026-9198, a code injection vulnerability affecting IBM Langflow, to its Known Exploited Vulnerabilities catalog. The entry says unauthenticated attackers can achieve full remote code execution on default Langflow deployments.
Add Updated KEV Files for 2026-08-05 · cisagov/kev-data@eebe24a · GitHub
Aug 4, 20263mo ago
CISA adds CVE-2026-34486 to KEV catalog
CISA added CVE-2026-34486, a missing encryption of sensitive data vulnerability affecting Apache Tomcat, to its Known Exploited Vulnerabilities catalog. The entry notes the flaw can bypass the EncryptInterceptor and maps to CWE-311.
Add Updated KEV Files for 2026-08-05 · cisagov/kev-data@eebe24a · GitHub
Aug 4, 20263mo ago
CISA adds CVE-2026-18556 to KEV catalog
CISA added CVE-2026-18556, an authentication bypass vulnerability affecting N-able N-central, to its Known Exploited Vulnerabilities catalog. The entry identifies the issue as CWE-288 and directs stakeholders to apply vendor mitigations under BOD 26-04.
Add Updated KEV Files for 2026-08-05 · cisagov/kev-data@eebe24a · GitHub

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Unauthenticated RCE in JetBrains TeamCity Agent Polling Protocol (CVE-2026-63077)

Affected products

2 linked

TeamcityTeamcity On-Premises

Organizations

1 linked

Jetbrains

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

6 references tracked. Mallory keeps watching after this page renders.

Rapid7 BlogNews · Aug 7, 2026

Rapid7 Analysis of CVE-2026-63077, an unauthenticated Remote Code Execution vulnerability in JetBrains TeamCityOpen source ↗

Security AffairsNews · Aug 6, 2026

U.S. CISA adds a JetBrains TeamCity flaw to its Known Exploited Vulnerabilities catalogOpen source ↗

The Hacker NewsNews · Aug 6, 2026

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the WildOpen source ↗

Cyber Security NewsNews · Aug 6, 2026

CISA Warns of TeamCity RCE Vulnerability Actively Exploited in AttacksOpen source ↗

Security WeekNews · Aug 6, 2026

Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability - SecurityWeekOpen source ↗

Cisa Kev Data CommitsAdvisories · Aug 5, 2026

Add Updated KEV Files for 2026-08-05 · cisagov/kev-data@eebe24a · GitHubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News