JetBrains Releases Security Advisory for Critical Vulnerability CVE-2026-63077
Exploitation of CVE-2026-63077 could allow unauthenticated remote code execution on vulnerable TeamCity On-Premises servers
Summary
Exploitation of CVE-2026-63077 could allow unauthenticated remote code execution on vulnerable TeamCity On-Premises servers
Affected platforms
The following platforms are known to be affected:
Threat details
Exploitation of CVE-2026-63077
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-63077 to the Known Exploited Vulnerabilities (KEV) catalog.
The vulnerability is critical, exploitation requires no authentication, and public technical details are available. The NHS England National CSOC assesses further exploitation as highly likely.
Introduction
JetBrains has released one security advisory to address a critical vulnerability in TeamCity On-Premises. Successful exploitation could allow an unauthenticated attacker to bypass authentication controls and remotely execute arbitrary commands with the privileges of the TeamCity server process.
CVE-2026-63077 - Deserialization of Untrusted Data (CWE-502) Vulnerability - CVSSv3.1: 9.8
Remediation advice
Affected organisations are encouraged to review JetBrains advisory Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077) and apply the relevant update as soon as possible.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 7 August 2026 12:39 pm