Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-08-08. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Active Exploitation14Disclosure3General3Patch3PoC1
2026-08-08
15
Active Exploitation10General1Patch4
2026-08-09
7
Active Exploitation6Disclosure1
2026-08-10
6
Active Exploitation4Disclosure1Patch1
2026-08-11
3
Active Exploitation2Patch1
2026-08-12
3
Active Exploitation3
2026-08-13
7
Active Exploitation3Disclosure1Exploit1Patch1PoC1
2026-08-14
2
Active Exploitation1Exploit1
2026-08-16
1
Disclosure1
2026-08-17
1
Active Exploitation1
2026-08-18
2
General1Patch1
2026-08-20
1
Patch1
2026-08-24
2
Active Exploitation2
2026-08-25
2
Active Exploitation1PoC1
2026-08-27
1
Active Exploitation1
2026-08-28
3
Active Exploitation1Disclosure1Patch1
2026-08-31
4
Active Exploitation3Patch1
2026-09-01
1
Active Exploitation1
2026-09-05
1
Active Exploitation1
2026-09-06
4
Active Exploitation3General1
2026-09-07
5
Active Exploitation5
2026-09-08
1
Active Exploitation1
2026-09-09
1
Active Exploitation1
2026-09-24
11
Active Exploitation11
2026-09-25
14
Active Exploitation13General1
2026-09-26
4
Active Exploitation4
2026-09-27
3
Active Exploitation3
2026-09-28
1
Active Exploitation1
2026-09-30
3
Active Exploitation3
2026-10-01
1
Active Exploitation1
2026-10-02
1
Active Exploitation1
2026-10-05
2
Active Exploitation2
2026-10-09
1
Patch1
2026-10-14
1
Disclosure1
>Full discourse20 posts
Stephen Fewer@stephenfewer·
Disclosure
We have published our @rapid7 analysis of CVE-2026-63077, an unauth RCE in JetBrains TeamCity that was disclosed last week and already added to KEV as being exploited in the wild. Check out our full analysis, IOCs, and PoC. This one has a gnarly gadget chain and a polygot SQL/JSP payload: https://www.rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/
Post summary
Rapid7 released an analysis of the unauthenticated RCE in JetBrains TeamCity, including PoC and evidence of active exploitation in the wild.
🚨 On-premise TeamCity is under attack.
CISA says attackers are exploiting CVE-2026-63077 in the wild. The 9.8-rated flaw can let unauthenticated attackers run OS commands, putting stored credentials, build artifacts, and downstream CI/CD pipelines at risk.
What is known so far 🠖 https://thehackernews.com/2026/08/cisa-flags-teamcity-cve-2026-63077-rce.html
Post summary
CISA reports that CVE-2026-63077, a high‑severity RCE in TeamCity, is actively exploited in the wild, threatening stored credentials and CI/CD pipelines.
🚨 IN THE WILD: CVE-2026-63077, a critical unauthenticated RCE in JetBrains TeamCity, is now being actively exploited.
A public PoC is also available, significantly increasing the risk to unpatched servers.
PoC: https://github.com/sfewer-r7/CVE-2026-63077
#TeamCity#JetBrains#CVE#RCE#CyberSecurity#Infosec#PoC
Post summary
CVE-2026-63077 is actively exploited in the wild, with a public PoC available and JetBrains TeamCity servers unpatched face a high risk.
🚨 A critical TeamCity flaw could let attackers run OS commands without logging in.
CVE-2026-63077 affects all on-premises versions and bypasses authentication through the agent polling protocol. JetBrains has released fixes and reports no known exploitation.
Full details - https://thehackernews.com/2026/07/critical-teamcity-flaw-could-let.html
Post summary
A critical TeamCity CVE enables unauthenticated OS command execution, but JetBrains has released a fix and reports no known exploitation in the wild.
🚨 SUPPLY CHAIN ALERT: JetBrains Cadence Breached via Unpatched TeamCity Flaw (CVE-2026-63077)
In what marks one of the most critical developer supply chain compromises this year, JetBrains confirmed that threat actors breached its cloud computing service, JetBrains Cadence, by exploiting an unpatched internal TeamCity server running in its own infrastructure.
🔍 What Happened
Vector: Attackers weaponized CVE-2026-63077, a critical unauthenticated Remote Code Execution (RCE) flaw in TeamCity caused by unsafe XStream deserialization within the agent polling protocol.
Target: The threat actor compromised http://api.cadence.jetbrains.com, which orchestrates remote compute and cloud development workloads.
Dwell Time: Malicious activity was active between August 8 and August 24, 2026, until JetBrains detected anomalous access and took the server offline.
Root Cause Oversight: Despite releasing fixes in late July, JetBrains confirmed the internal Cadence TeamCity instance missed scheduled patching.
💥 What Was Stolen & Compromised
AWS IAM Credentials: Multiple active AWS credentials and secrets used by Cadence were exfiltrated, including IAM keys belonging to JetBrains internal employees.
Cloud Storage Access: Unsanctioned access to Amazon S3 buckets inside JetBrains AWS accounts linked to the Cadence environment.
2024 Full Server Backup: A complete historical Cadence archive containing customer source code, build configs, sensitive system logs, and tokens.
User PII: Usernames, real names, registered emails, last-login timestamps, and connecting IP addresses.
🛡️ Mitigation & Action Items for DevSecOps Teams
Immediate Credential Rotation:
Invalidate and rotate any AWS IAM credentials, personal access tokens (PATs), and API keys utilized with or exposed to JetBrains Cadence workloads.
Patch On-Prem TeamCity Now:
Upgrade all on-premise TeamCity deployments to version 2025.11.7, 2026.1.3, or install the official vendor security patch plugin.
CI/CD Perimeter Hardening:
Remove CI/CD orchestrators from the public internet; restrict agent polling and web access behind an enterprise VPN or zero-trust network gateway.
Hunt for IoCs in TeamCity Logs:
Audit registered build agents for rogue entries or names starting with scan*.
Monitor /app/agents/v1/commands/error endpoints for abnormal deserialization POST payloads and unexpected .jsp file drops in server webroots.
Treat any artifact built on unpatched environments as untrusted until validated.
CC:@BushidoToken,
@Kostastsale
, @reach2ratan
, @cglyer
, @Gi7w0rm
, @TheDFIRReport
, @malwrhunterteam
, @vxunderground#CyberSecurity#Infosec#DevSecOps#SupplyChain#JetBrains#TeamCity#ThreatIntel#ZeroDay#AWS
Post summary
JetBrains Cadence was compromised through unpatched TeamCity CVE-2026-63077, highlighting a critical RCE vulnerability; the breach emphasizes the urgency of patching and credential rotation.
The post announces a critical remote code execution vulnerability in JetBrains TeamCity versions older than 2026.1.3 and 2025.11.7, but provides no exploitation code or patches.
The linked article discloses CVE‑2026‑63077, a pre‑authentication remote code execution flaw due to XStream deserialization in JetBrains TeamCity’s agent polling protocol.
@rapid7 We also now have a @metasploit exploit module in the pull queue for CVE-2026-63077, supporting both JSP and CMD payloads along with payload/agent cleanup: https://github.com/rapid7/metasploit-framework/pull/21775 https://t.co/uocdcqQWKc
Post summary
A new Metasploit module for CVE-2026-63077 is now queued for integration, providing JSP and CMD payload support along with cleanup routines.
🛡️We added JetBrains TeamCity deserialization of untrusted data #RCE vulnerability CVE-2026-63077 to our KEV Catalog. Visit http://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity#InfoSec https://t.co/PlAFbIF3EG
Post summary
The tweet announces that CVE-2026-63077 (an RCE in JetBrains TeamCity) has been added to the KEV catalog and urges organizations to apply mitigations.
🚨 On 7/27/26, #JetBrains published a security advisory for CVE-2026-63077, a critical vuln. affecting all versions of TeamCity On-Premises.
Attackers who exploit the vulnerability can read stored credentials and compromise CI/CD pipeline integrity. More: https://r-7.co/4h3tVFR https://t.co/Zz9MJ2iCXs
Post summary
JetBrains released a new critical advisory for CVE-2026-63077 affecting TeamCity On‑Premises, exposing stored credentials and pipeline integrity.
🚨 CISA FLAGS CRITICAL TEAMCITY RCE FOR RANSOMWARE USE — CI/CD SERVERS AT RISK
CISA's Known Exploited Vulnerabilities catalog lists CVE-2026-63077, a critical JetBrains TeamCity On-Premises flaw, as known to be used in ransomware campaigns.
• CVE-2026-63077 — CVSS 9.8 — affects TeamCity On-Premises
• An unauthenticated attacker with HTTP(S) access can exploit the TeamCity agent polling protocol to run OS commands with the TeamCity server process privileges
• Successful exploitation can expose TeamCity data, configurations and stored credentials, alter server state, and put build artifacts and downstream CI/CD pipelines at risk
• JetBrains previously reported active exploitation against unpatched TeamCity servers after disclosure
• Fixed in TeamCity 2025.11.7 and 2026.1.3; a security patch plugin is available for TeamCity 2017.1+
• TeamCity Cloud customers do not need to patch this issue
• CISA has not publicly attributed a specific ransomware group or victim set to this CVE
⚠️ Analyst Note:
The ransomware-use designation raises the operational stakes. TeamCity often holds source access, deployment credentials, signing material and cloud secrets. Internet-reachable, unpatched instances should be treated as an incident-response problem as well as a patching task: review logs and unexpected agents, and assess rotation for secrets reachable from a compromised server.
Original JetBrains advisory:
https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/
JetBrains exploitation guidance:
https://blog.jetbrains.com/teamcity/2026/08/cve-2026-63077-update/
CISA Known Exploited Vulnerabilities Catalog:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
#TeamCity#JetBrains#CVE202663077#Ransomware#RCE#CICD#SupplyChain#ThreatIntel#DDW
Post summary
CISA has added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog, citing active exploitation in ransomware campaigns against unpatched TeamCity servers, with a critical CVSS 9.8 RCE flaw and available patches in specific versions.
Daniel's Daily Threat Intel & CVE Briefing — Fri 7 Aug 2026
Top of the stack: Today is CISA's federal remediation due date for the N-able N-central / Langflow / Tomcat KEV batch — and the N-central bug is the one that matters: CVE-2026-18577, an auth-bypass that is a bypass of the incomplete fix for CVE-2026-18556, is being exploited in the wild since Aug 1 to seize admin on RMM servers and pivot into managed endpoints. If you or clients run N-central, patch to 2026.3.1 Hotfix 1 (2026.3.1.7) and hunt for post-compromise activity before anything else today.
1. CISA KEV / actively exploited (lead)
CVE-2026-18577 — N-able N-central, all versions ≤ 2026.3.1 (pre-Hotfix 1). Unauth auth-bypass → full admin. Exploited in the wild from Aug 1; added to KEV Aug 3. Post-exploit TTPs: abuse of the Take Control feature to reach managed endpoints + Cloudflare Tunnel for persistent backdoor. Fix: 2026.3.1.7. So what: RMM = one box to own the whole estate; treat any unpatched N-central as presumed-compromised.
CVE-2026-18556 — N-able N-central auth-bypass (the incompletely-patched precursor to 18577), CVSS 8.2. KEV, federal due date today.
CVE-2026-9198 — Langflow (open-source AI app-dev platform), CVSS 9.8, unauth code-injection → RCE. Fixed 1.10.1. Repeatedly weaponized in recent months; KEV, due today. So what: internet-exposed AI/LLM tooling is now a routine initial-access target.
CVE-2026-34486 — Apache Tomcat, CVSS 7.5, EncryptInterceptor cluster-messaging bypass. Fixed 11.0.21 / 10.1.54 / 9.0.117. Tied to SNOWLIGHT malware campaign; KEV, due today.
CVE-2026-63077 — JetBrains TeamCity deserialization flaw, added to KEV this week. Verify your CI/CD estate isn't exposing TeamCity to untrusted networks.
2. Edge / network gear
CVE-2026-20316 — Cisco Secure Firewall Management Center (FMC) 7.0–7.7 / 10.0. Static credentials for a low-priv account → unauth remote access to sensitive data; actively exploited as a zero-day (disclosed Jul 30). Base CVSS only 5.3 but Cisco rates SIR High because it's chainable for privilege escalation. So what: not the headline score, but it's live and it's your firewall manager — patch and rotate.
Fortinet/Ivanti criticals (FortiSandbox CVE-2026-25089 9.8; Ivanti Sentry CVE-2026-10520 10.0 / CVE-2026-10523 9.9) are from the June 10 cycle — no new exploitation reported in the last 24–48h; flagged only in case anything remains unpatched.
3. Microsoft / Windows / AD
Quiet in the last 24h. No new in-the-wild Windows/AD/Exchange/Entra items surfaced. August Patch Tuesday lands Aug 11 — July's record 622-flaw cycle (2 zero-days under active attack) should already be deployed; if not, that's your gap.
4. Web / cloud / DevOps
CVE-2026-66066 — Rails Active Storage (< 7.2.3.2, 8.0.x < 8.0.5.1, 8.1.x < 8.1.3.1; 6.x only if configured off-default). Critical; unauth arbitrary file read → potential RCE via libvips ("KindaRails2Shell", pivots on the app master key). Public PoC available (disclosed Aug 1). Mitigation: upgrade Rails/Active Storage, libvips ≥ 8.13, ruby-vips ≥ 2.2.1.
CVE-2026-63030 + CVE-2026-60137 — WordPress core "wp2shell" chain (REST batch-route confusion + author__not_in SQLi). Unauth RCE on default installs 6.9.0–6.9.4 / 7.0.0–7.0.1. Public exploits on GitHub; watchTowr reports in-the-wild exploitation. Fixed 6.9.5 / 7.0.2 (forced auto-update pushed). Slightly older (Jul 18) but still actively exploited — worth a scan sweep.
Watch / developing
Oracle out-of-band Security Alert CVE-2026-35273 surfaced this week — details thin, worth confirming scope. Senserva notes ~30 KEV entries this month with 2 tied to ransomware campaigns (Microsoft/Fortinet/Cisco most-affected) — watch for ransomware operators folding the N-central and Langflow bugs into their access-broker playbooks.
Sign-off: 7 items flagged actively exploited today (N-central ×2, Langflow, Tomcat, TeamCity, Cisco FMC, WordPress wp2shell); the single must-do is patching N-central before CISA's due date closes.
Sources:
CISA — Adds Three KEVs (Aug 4)
CISA — Adds One KEV (Aug 3)
The Hacker News — CISA flags Langflow, Tomcat, N-central
Rapid7 — CVE-2026-18577 N-central exploited in the wild
N-able — N-central Security Update (Aug 2)
The Hacker News — Cisco FMC zero-day actively exploited
BleepingComputer — Rails Active Storage RCE (CVE-2026-66066)
BleepingComputer — WordPress wp2shell RCE public exploits
SecurityWeek — Fortinet/Ivanti critical patches
Senserva — CISA KEV additions this week
One caveat worth noting for your own verification: NVD detail pages were unreachable during this run, so severities above are corroborated against vendor advisories, CISA, and reputable trackers rather than NVD directly — the Langflow 9.8 and Cisco 5.3 figures each have two independent sources, but confirm against NVD before citing formally.
Post summary
The brief highlights that several high‑severity CVEs—including N‑central auth‑bypass, Langflow code injection, Tomcat interceptor bypass, and WordPress wp2shell—are actively exploited in the wild and urges immediate patching with vendor‑released hotfixes.
A PoC/exploit has been discovered for vulnerability CVE-2026-63077
Vendor: JetBrains
Product: TeamCity
Description: In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
Link: https://github.com/sfewer-r7/cve-2026-63077
#dbugs_vuln
Post summary
A proof‑of‑concept exploit for CVE‑2026‑63077 has been published, detailing an unauthenticated RCE in JetBrains TeamCity via the agent polling protocol, but no reports of real‑world exploitation or patches are mentioned.
🚨 CISA Confirms Active Exploitation of Critical JetBrains TeamCity RCE Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added **CVE-2026-63077** to its **Known Exploited Vulnerabilities (KEV) Catalog**, confirming that the flaw is being actively exploited in the wild.
* CVE-2026-63077 is a **critical (CVSS 9.8)** unauthenticated remote code execution vulnerability affecting **JetBrains TeamCity On-Premises**.
* Attackers can bypass authentication via the TeamCity agent polling protocol and execute arbitrary operating system commands with the privileges of the TeamCity server process.
* TeamCity Cloud is **not affected**. Fixed versions are **2026.1.3** and **2025.11.7**, with a security patch plugin available for older supported releases.
* CISA has not released public details about the observed attacks, including the threat actors, victim count, or payloads used.
**Analyst Note:** TeamCity servers often hold highly privileged assets, including source code, signing keys, cloud credentials, and CI/CD pipeline secrets. A successful compromise can provide attackers with a direct path into an organization's software supply chain. Organizations running internet-facing TeamCity On-Premises instances should treat this as an emergency and patch immediately.
* CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
* JetBrains Advisory: https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/
#DDW#CyberSecurity#TeamCity#Vulnerability#DDW#CyberSecurity#TeamCity#Vulnerability
Post summary
CISA confirms that CVE‑2026‑63077, a critical unauthenticated remote code execution in JetBrains TeamCity On‑Premises, is actively being exploited, and organizations are urged to patch immediately to the specified fixed versions.
CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity, is exploited in the wild. PoC exploit code and full details are now public.
#CVE202663077#TeamCity#JetBrains#RemoteCodeExecution#KEV#InfoSec
http://securityonline.info/cve-2026-63077-teamcity-rce-exploited/
Post summary
CVE-2026-63077 is an unauthenticated remote code execution in JetBrains TeamCity, actively exploited in the wild, with publicly available PoC code.
CISA confirmed that CVE‑2026‑63077 is being actively exploited, with the JetBrains TeamCity remote code execution vulnerability already in the wild. Patches are available, but the CVE remains critical.
Vulnerability CVE‑2026‑63077 in JetBrains TeamCity On‑Premises is a remote code execution flaw; exploit code has been publicly released and active exploitation has been confirmed, though no patch or workaround is mentioned.
