CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-63077)
CISA has added CVE-2026-63077, a deserialization of untrusted data vulnerability in JetBrains TeamCity, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This flaw allows attackers to gain total control of the affected asset post-exploitation. FCEB agencies are required to remediate this under BOD 26-04, and all organizations are encouraged to prioritize patching and check for prior compromise.
Detection / Hunteropenrouter
What Happened
The US Cybersecurity and Infrastructure Security Agency (CISA) has flagged a serious software flaw in JetBrains TeamCity, a popular tool for developers, because hackers are actively exploiting it. This flaw, officially known as CVE-2026-63077, allows attackers to take full control of the affected system. Government agencies are required to fix this issue promptly, and CISA advises all other organizations to do the same. If you use this software, you should update it immediately and check if your system was already compromised.
Key Takeaways
- CISA added CVE-2026-63077 to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation.
- The vulnerability is a deserialization of untrusted data flaw in JetBrains TeamCity that grants total control of the asset post-exploitation.
- Federal Civilian Executive Branch (FCEB) agencies are required to remediate this vulnerability under BOD 26-04.
- Organizations are encouraged to check for compromise prior to applying the patch.
Affected Systems
- JetBrains TeamCity
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-63077 | JetBrains TeamCity | Critical | Deserialization of untrusted data vulnerability that allows attackers to gain total control of the affected asset post-exploitation. |
Attack Chain
- Initial Access: Exploitation of CVE-2026-63077 in JetBrains TeamCity via deserialization of untrusted data.
- Execution: Successful exploitation leads to remote code execution on the TeamCity server.
- Impact: Attacker gains total control of the compromised asset.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide any detection rules or queries.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The article does not describe post-exploitation behavior or specific indicators of compromise for endpoint detection. |
| Network Visibility | Low | No network IOCs or exploit payload details are provided in the alert. |
| Detection Difficulty | Moderate | Detecting exploitation requires knowledge of the specific deserialization payload or anomalous behavior originating from the TeamCity application, which is not detailed in this alert. |
Required Log Sources
- JetBrains TeamCity application logs
- Endpoint Detection and Response (EDR) telemetry
- Web application firewall (WAF) logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for unexpected child processes spawned by the TeamCity application service, which may indicate successful exploitation of the deserialization flaw. | EDR process telemetry | Execution | Low |
| Look for anomalous authentication events or privilege escalation within TeamCity audit logs following the exploitation window. | Application logs | Persistence | Medium |
Control Gaps
- Signature-based network detection may miss the exploit if the payload is obfuscated or delivered over an encrypted channel.
- Lack of application-level logging on the TeamCity server may prevent detection of post-exploitation activities.
Key Behavioral Indicators
- Anomalous process execution originating from the TeamCity service account.
- Unexpected network connections from the TeamCity server to unknown external IP addresses.
False Positive Assessment
Low
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting. Apply the latest security patch for JetBrains TeamCity immediately.
- If patching is delayed, consider isolating or disabling the TeamCity server if business operations permit.
- Review logs for signs of prior compromise before applying the patch, as the vulnerability may have already been exploited.
Infrastructure Hardening
- Evaluate whether network segmentation can restrict access to the TeamCity server to only necessary internal subnets.
- Consider implementing a Web Application Firewall (WAF) to filter malicious requests targeting the deserialization vulnerability.
User Protection
- Ensure the TeamCity service account operates with least privilege permissions to limit the impact of a potential compromise.
Security Awareness
- Inform development and IT teams about the critical vulnerability and the need to apply updates promptly.
