JetBrains TeamCity On-Prem Unauthenticated RCE
CVSS 9.8 critical. Unauthenticated remote code execution in all JetBrains TeamCity On-Premises versions, fixed in 2025.11.7 and 2026.1.3.
- Vendor
- JetBrains
- Product
- TeamCity On-Premises (all versions)
- CVSS
- 9.8
- EPSS (exploit probability)
- 94.9%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-63077 being exploited?
Yes. CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 94.9% (scored November 4, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-63077 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Unauthenticated remote code execution in all on-premises versions of JetBrains TeamCity. A remote attacker with network access to the TeamCity port can execute arbitrary operating system commands on the host server without any credentials.
Fixed in 2025.11.7 (LTS branch) and 2026.1.3 (current branch). TeamCity Cloud was patched automatically.
CISA added CVE-2026-63077 to the Known Exploited Vulnerabilities catalog on August 5, 2026, with a federal remediation deadline of August 8. Active exploitation is confirmed: attackers breached JetBrains’ own Cadence ML platform using this flaw between August 8 and August 23, extracting AWS IAM credentials, a full server backup, and PyCharm project source code. Rapid7 identified the TeamCity agent-listener protocol as a secondary attack surface beyond the main RCE path.
Consult JetBrains security advisories and the NVD entry for current status.
Other JetBrains CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerabilityransomware use | [ HIGH ] | 7.3 | 100.0% | |
| CVE-2024-27198 JetBrains TeamCity Authentication Bypassransomware usewrite-up | [ CRITICAL ] | 9.8 | 99.9% | |
| CVE-2023-42793 JetBrains TeamCity Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% |
- Chinese APT Warlock Ransomware Targets Iberia
- Ransomware Hits South Africa Air Traffic Control
- Keio Group Ransomware Disrupts Business Systems, Not Trains
- CISA Adds MikroTik RouterOS Chain Flaw to KEV Catalog
- CISA KEV: WSO2 and Adobe Commerce Flaws Exploited
- Ryuk Member Gets 2 Years for $1.2M Ransomware Attacks