Jetbrains CVE-2026-63077 Zero-Day Added to CISA KEV Under Active Exploitation
Key findings • Jetbrains CVE-2026-63077 added to CISA KEV due to active exploitation. • The vulnerability is confirmed as a zero-day exploit. • Immediate patching of all affected Jetbrain…
Key findings
- Jetbrains CVE-2026-63077 added to CISA KEV due to active exploitation.
- The vulnerability is confirmed as a zero-day exploit.
- Immediate patching of all affected Jetbrains products is critical.
- CISA mandates remediation by August 5, 2026, for federal agencies.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert by adding a newly identified Jetbrains vulnerability, CVE-2026-63077, to its authoritative Known Exploited Vulnerabilities (KEV) Catalog. This inclusion signifies that the flaw is under active exploitation by malicious actors in real-world attacks, elevating its risk profile significantly. The KEV catalog serves as a crucial resource for federal civilian executive branch agencies, mandating the remediation of listed vulnerabilities within specified deadlines due to their proven threat.
Designated as CVE-2026-63077, this specific vulnerability within the Jetbrains ecosystem has been confirmed as a zero-day exploit, meaning adversaries were leveraging it before a patch was widely available. While specific details regarding the nature of the exploit are still emerging, its presence in the KEV catalog underscores its severity and the immediate danger it poses to unpatched systems. Organizations utilizing Jetbrains products should consider this a high-priority threat.
The active exploitation of CVE-2026-63077 necessitates an urgent response from all organizations, not just federal entities. Attackers are actively scanning for and compromising vulnerable systems, potentially leading to unauthorized access, data breaches, or further system compromise. The window of opportunity for defenders to mitigate this risk is closing rapidly as threat actors continue to weaponize this flaw.
To counter this immediate threat, defenders are strongly advised to identify and patch all instances of affected Jetbrains products without delay. CISA's Binding Operational Directive (BOD 22-01) mandates that federal agencies remediate KEV vulnerabilities by a specific due date, which for CVE-2026-63077 is August 5, 2026. All other organizations should adopt a similar urgency, prioritizing the application of vendor-provided security updates to protect their environments from ongoing attacks. Regular vulnerability scanning and robust patch management practices are essential to prevent exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a formal warning regarding CVE-2026-63077, a critical remote code execution vulnerability affecting JetBrains TeamCity On-Premises. This flaw allows unauthenticated attackers to execute arbitrary OS commands, posing a significant supply-chain risk by potentially compromising source code, build settings, and deployment pipelines. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating remediation for federal agencies by August 8, 2026.
The US cybersecurity agency CISA has added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. This designation mandates federal agencies to patch the JetBrains TeamCity vulnerability within three days. While JetBrains initially reported no awareness of active exploitation, CISA's inclusion indicates a shift, with threat actors now actively targeting the flaw.
CISA has officially added CVE-2026-63077, a critical remote code execution vulnerability in JetBrains TeamCity on-premise versions, to its Known Exploited Vulnerabilities (KEV) catalog. This advisory confirms that the deserialization of untrusted data flaw, which carries a CVSS score of 9.8, is being actively exploited in the wild, necessitating immediate patching for all affected federal agencies by August 8, 2026.
This Rapid7 analysis provides a deep dive into the technical mechanics of CVE-2026-63077, detailing how an overly permissive XStream allowlist in TeamCity versions prior to 2026.1.3 enables unsafe deserialization. It highlights that the vulnerability stems from XStream's default permissions not being cleared before TeamCity's specific allowlist is applied, allowing attackers to execute OS commands with the privileges of the TeamCity server process. The analysis also includes a proof-of-concept script and confirms that the patch successfully remediates the exploit.