Our takeCISA added CVE-2026-63077 (JetBrains TeamCity deserialization of untrusted data) to KEV: confirmed in-the-wild exploitation. Patch immediately if you run TeamCity.Cyber Resilience desk
Sources (1)
- cisa_advisories · cisa_advisories
What this means for you — Security leader:Patch CVE-2026-63077 in all JetBrains TeamCity instances immediately; it is confirmed exploited in the wild and now on the KEV list.
What this means for you — Lean IT orgs:If you run JetBrains TeamCity, update it right away. This vulnerability lets attackers take control and is already being used against organizations.
What this means for you — MSP:Check every client TeamCity deployment for CVE-2026-63077 and patch it now; it is actively exploited and carries Binding Operational Directive weight for federal customers.
What this means for you — Researcher:CVE-2026-63077 (JetBrains TeamCity unsafe deserialization) added to KEV with confirmed in-the-wild exploitation.