CISA Flags Team City CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild
Summary: CISA says CVE-2026-63077, a deserialization of untrusted data flaw with a CVSS score of 9.8 in on-premise JetBrains TeamCity, is under active exploitation in the wild, allowing an unauthenticated attacker to bypass authentication via the agent polling protocol and execute arbitrary operating system commands with the TeamCity server process's privileges. Rapid7's August 7, 2026 analysis found the flaw stems from a permissive XStream allowlist that adds TeamCity protocol classes without removing XStream's default permissions, and it released a proof-of-concept Python script that writes a .JSPWS file to run an arbitrary command and then deletes it.
What's compelling: Federal civilian agencies face an August 8, 2026 patching deadline under BOD 26-04, and a successful attack can expose stored credentials and compromise the integrity of build artifacts and downstream CI/CD pipelines - while the identity of the attackers and the scale of exploitation remain unknown.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-63077
- Related
- CVE-2026-63077: Jet Brains Team City Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Aug 05, 2026