AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

🔥 This vulnerability is being actively exploited in the wild (CISA Known Exploited Vulnerabilities catalog)

CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

criticalvulnerability🔥 Actively Exploited

security

Source: CISA Known Exploited VulnerabilitiesAugust 4, 2026CVE-2026-63077

Summary

JetBrains TeamCity has a deserialization of untrusted data vulnerability (a flaw where the software unsafely processes data from untrusted sources, allowing attackers to execute malicious code), which allows unauthenticated attackers to gain RCE (remote code execution, the ability to run commands on a system they don't control) through the agent polling protocol. This vulnerability is actively being exploited by attackers.

Solution / Mitigation

Apply mitigations in accordance with vendor instructions (JetBrains). Follow CISA's BOD 26-04 guidance for patching based on risk and the 'Forensics Triage Requirements' document. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. Evaluate each system's internet exposure and ensure adherence to BOD 26-04 patching guidelines by the due date of 2026-08-08. See the JetBrains TeamCity blog and security issues page for specific patches or updates.