JPCERT

JetBrains TeamCity CVE-2026-63077 Actively Exploited in the Wild, JPCERT Urges Immediate Patching and Breach Investigation

A critical deserialization vulnerability tracked as CVE-2026-63077 has been discovered in JetBrains TeamCity, allowing unauthenticated remote code execution through the agent polling protocol. The flaw was privately reported to JetBrains on July 10, 2026, and publicly disclosed on July 27 with patches released in TeamCity 2026.1.3 and 2025.11.7. Following disclosure, active exploitation was confirmed, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities Catalog on August 5 and mandate federal agencies to remediate by August 8. JetBrains issued its own exploitation warning on August 7. JPCERT/CC has verified that affected versions remain in use within Japan and notes that public exploit code is now available, recommending organizations verify their deployments, apply updates promptly, and conduct compromise assessments.