CISA Flags Exploitation of Critical JetBrains TeamCity Flaw
Summary
CISA added critical TeamCity vulnerability CVE-2026-63077 to its Known Exploited Vulnerabilities catalog. The flaw enables unauthenticated remote code execution; patches are available, but public details about attacks are lacking.
Key points
- CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog and urged federal agencies to patch within three days.
- The flaw affects all TeamCity On-Premises versions and can allow unauthenticated remote code execution through HTTP/S requests.
- JetBrains described the issue as untrusted-data deserialization that can bypass authentication and execute operating-system commands with TeamCity server-process privileges.
- Patches are available in TeamCity versions 2025.11.7 and 2026.1.3; JetBrains also released a security patch plugin for version 2017.1 and later.
- JetBrains had said it was unaware of active exploitation, and the article reports no public information about the attacks.
Article Details
- Vulnerability Types
- Deserialization of untrusted data
- Remote code execution
- Severity
- Critical (CVSS 9.8)
- Affected Versions
- TeamCity On-Premises (all versions)
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available