Is CVE-2026-63077 actively exploited?

Yes. KEV Intelligence tracks CVE-2026-63077 as a known exploited vulnerability. Confidence is confirmed.

What exploitation activity has KEV Intelligence observed?

KEV Intelligence has not yet recorded sensor-observed exploitation attempts for CVE-2026-63077. Our sensors continue to monitor for activity targeting this CVE.

Which versions are affected?

CVE-2026-63077 affects JetBrains TeamCity. Reported affected version: 0 to < 2026.1.3, 2025.11.7.

Yes. CVE-2026-63077 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-63077 Exploited in the Wild — TeamCity

Q: What is CVE-2026-63077?

CVE-2026-63077 is an unauthenticated vulnerability affecting JetBrains TeamCity. In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Q: How should organizations remediate it?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Q: Is it in CISA KEV?

Yes. CVE-2026-63077 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-63077 is an unauthenticated vulnerability affecting JetBrains TeamCity. In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Is it exploited?

Yes. KEV Intelligence tracks this CVE as a known exploited vulnerability. Confidence is confirmed.

Who is affected?

JetBrains / TeamCity affected before 2026.1.3, 2025.11.7.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

TeamCity Remote Code Execution

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Vendor Product Affected Status

JetBrains TeamCity Before 2026.1.3, 2025.11.7 Affected

Published: 27 Jul 2026
Exploitation Reported: 05 Aug 2026
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-63077
jetbrains.com/privacy-security/issues-fixed jetbrains.com · CVE Record https://www.jetbrains.com/privacy-security/issues-fixed/

Exploitation evidence

Why KEV Intelligence marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

CISA

Recorded 05 Aug 2026

Independent exploitation attestation added to the KEV Intelligence record.

Proof of concept available

GitHub

Recorded 08 Aug 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the KEV Intelligence Pro API.

Learn about Pro API access

Source	Added
CISA First	2026-08-05 16:50 UTC
CVE	2026-08-05 18:01 UTC
TheHackerNews	2026-08-06 06:51 UTC
Rapid7	2026-08-07 14:32 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets: 0
User-Agents: 0

Raw values available in Pro and Enterprise.

Scanner coverage

Nuclei template detected 10 Aug 2026.

View Nuclei template

Virtual patch status

No KEV Intelligence virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63077.yaml	10 Aug 2026

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

10.7%

Weaknesses

Deserialization of Untrusted Data CWE-502

Recent mention · Rapid7

Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)

OverviewOn July 27, 2026, JetBrains published a security advisory for CVE-2026-63077, a critical unsafe deserialization vulnerability affecting JetBrains TeamCity. An attacker who can reach a TeamCity server over HTTP or HTTPS can exploit the agent polling protocol without...

Read full advisory

All Mentions

Recent mention · Rapid7

Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)

Rapid7 · 07 Aug 2026

OverviewOn July 27, 2026, JetBrains published a security advisory for CVE-2026-63077, a critical unsafe deserialization vulnerability affecting JetBrains TeamCity. An attacker who can reach a TeamCity server over HTTP or HTTPS can exploit the agent polling protocol without credentials and execute operating system commands with the privileges of the TeamCity server process.JetBrains reported no known active exploitation when it disclosed the vulnerability. However, on August 5, 2026, CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog, confirming exploitation in...

Recent mention · TheHackerNews

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild

TheHackerNews · 06 Aug 2026

A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability in question is CVE-2026-63077 (CVSS score: 9.8), a case of deserialization of untrusted data that could allow an unauthenticated attacker with access to a TeamCity server

Recent mention · Rapid7

CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity

Rapid7 · 29 Jul 2026

OverviewOn July 27, 2026, JetBrains published a security advisory for CVE-2026-63077, a critical unauthenticated vulnerability affecting all versions of TeamCity On-Premises. The issue is classified as deserialization of untrusted data and has a CVSS score of 9.8. An unauthenticated remote attacker with HTTP(S) access to a TeamCity server can exploit the agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.In the blog post that JetBrains shared in tandem with CVE publication, they stated...

Recent mention · TheHackerNews

Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In

TheHackerNews · 28 Jul 2026

JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

AnggaTechI/CVE-2026-63077

github · Created 2026-08-08 06:32:09 UTC · 0 stars · AI assessment 90%

CVE-2026-63077 — Unauthenticated Remote Code Execution in JetBrains TeamCity via agent polling protocol deserialization. CVSS 9.8 CRITICAL. Mass exploitation tool with interactive shell, multi-threading, and real-time result logging.

sfewer-r7/CVE-2026-63077

github · Created 2026-08-07 08:38:01 UTC · 1 stars · AI assessment 90%

Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)

JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution

nuclei · Created Unknown

Timeline

From disclosure to observed exploitation

10 Aug 2026
Nuclei template available

Scanner coverage available
07 Aug 2026
KEV confirmed by Rapid7

Exploitation attested by an external source
07 Aug 2026
Public PoC available

Public proof-of-concept code published
06 Aug 2026
KEV confirmed by TheHackerNews

Exploitation attested by an external source
05 Aug 2026
KEV confirmed by CVE

Exploitation attested by an external source
05 Aug 2026
Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
27 Jul 2026
CVE published

Vulnerability disclosed publicly
15 Jul 2026
CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-63077

Free JSON includes basic KEV fields

{
  "cve_id": "CVE-2026-63077",
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "cvss_estimated": false,
  "epss_score": 0.10722,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

CVE-2026-63077

What security teams need to know first

TeamCity Remote Code Execution

Tags

CVE References

Why KEV Intelligence marks this CVE as exploited

Exploited in the wild

Proof of concept available

Known exploited vulnerability sources

Operational artifacts and observed signals

Observed signals

Scanner coverage

Virtual patch status

Scanner Artifacts

Severity, weaknesses, and research context

Weaknesses

Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)

All Mentions

Potential Proof of Concepts

From disclosure to observed exploitation

Nuclei template available

KEV confirmed by Rapid7

Public PoC available

KEV confirmed by TheHackerNews

KEV confirmed by CVE

Added to CISA KEV

CVE published

CVE ID reserved

Automate this intelligence

Get alerts on high-impact exploitation