Loading story…
CISA confirmed that ransomware campaigns are exploiting CVE-2026-63077, a CVSS 9.8 unauthenticated remote-code-execution flaw in JetBrains TeamCity. The deserialization vulnerability affects the agent polling protocol and can allow remote attackers to execute code without authentication; CISA updated its Known Exploited Vulnerabilities catalog to mark ransomware use as known.
JetBrains released a fix on July 25, and CISA added the flaw to the KEV catalog in August with an August 8 remediation deadline under BOD 26-04. Organizations should urgently apply vendor mitigations to exposed TeamCity servers, rotate build, signing, cloud, and access credentials that may have been exposed, and investigate build logs, pipeline configurations, and artifacts for unauthorized changes or downstream compromise.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
CISA updated CVE-2026-63077's KEV entry to change its ransomware-campaign-use status from Unknown to Known, confirming exploitation in ransomware campaigns.
CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog and directed organizations to apply vendor mitigations. The catalog set an August 8 remediation due date and marked the issue as requiring forensic triage.
JetBrains released a patch for CVE-2026-63077, a CVSS 9.8 unauthenticated remote-code-execution flaw in TeamCity's agent polling protocol.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **CVE-2026-63077** to its Known Exploited Vulnerabilities catalog after attackers began exploiting a critical JetBrains TeamCity On-Premises flaw that enables **unauthenticated remote code execution**. The vulnerability stems from deserialization of untrusted data in the TeamCity agent polling protocol and can be triggered over HTTP or HTTPS, allowing attackers to bypass authentication and execute operating system commands on exposed servers. JetBrains said all TeamCity On-Premises versions were affected until fixes shipped in **2025.11.7** and **2026.1.3**, and also released a security patch plugin for versions **2017.1 and later** as a temporary mitigation path. Under **BOD 26-04**, CISA ordered federal civilian agencies to remediate by **2026-08-08**. A successful compromise of TeamCity can expose source code, secrets, signing material, and deployment connections, raising the risk of broader software supply-chain compromise.
Aug 7, 2026
CISA added **CVE-2026-63077** to its Known Exploited Vulnerabilities catalog, raising the total number of listed flaws from 1660 to 1661. The vulnerability affects **JetBrains TeamCity** and is described as a deserialization of untrusted data issue that could allow **unauthenticated remote code execution** through the TeamCity agent polling protocol. CISA mapped the flaw to **`CWE-502`**, said known ransomware use is currently unknown, and directed organizations to apply vendor mitigations and follow **BOD 26-04** and forensic triage guidance. Public defender activity followed quickly, with a **Nuclei** template pull request opened for **CVE-2026-63077** covering TeamCity versions earlier than **2026.1.3** and **2025.11.7**. The repository activity showed the detection template moving through review and merge workflow, indicating that scanning coverage for the newly cataloged, exploited TeamCity flaw was being prepared as organizations faced a CISA remediation due date of **2026-08-08**.
Aug 7, 2026
Attackers exploited **CVE-2026-63077**, a critical (CVSS 9.8) authentication-bypass and arbitrary-command-execution flaw affecting all JetBrains TeamCity On-Premises versions, to compromise an unpatched TeamCity server supporting JetBrains’ Cadence cloud development service. Activity at `api.cadence.jetbrains.com` ran from August 8 to August 24 and may have exposed a 2024 server backup, user data, source code, credentials, configurations, build artifacts, and logs. JetBrains confirmed compromise of several AWS IAM users and access to files in its AWS S3 buckets, while it continued investigating whether customer storage buckets were accessed. Australian authorities and CISA had already warned of active exploitation and urged organizations to identify exposed TeamCity instances, apply JetBrains updates or its security patch plugin, and remove TeamCity interfaces from direct internet exposure where possible. Public exploit support has also advanced through Metasploit module `exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077`, including improved payload selection for Java/JSP, Windows, and Linux targets. Cadence users should rotate every credential and secret handled by the service, investigate connected environments for unauthorized activity and lateral movement, and treat executions and outputs generated during the exposure period as untrusted.
Aug 28, 2026