Active Exploitation of JetBrains TeamCity Deserialization Flaw Triggers CISA KEV Listing
CVE-2026-63077, a deserialization vulnerability in JetBrains TeamCity, has been actively exploited in the wild, prompting CISA to add it to the Known Exploited Vulnerabilities Catalog. Deserialization flaws are particularly dangerous because they can allow attackers to execute arbitrary code on vulnerable systems, potentially compromising CI/CD pipelines and the software supply chain. TeamCity is widely used in enterprise development environments, meaning a successful exploit could cascade into downstream systems and codebases. FCEB agencies are now mandated to remediate under BOD 26-04, but all organizations should treat KEV-listed vulnerabilities as urgent priorities regardless of regulatory obligation.
Tactical Insight
Immediate actions
- Apply the latest JetBrains TeamCity patch or upgrade to a non-vulnerable version without delay.
- Temporarily restrict public internet access to TeamCity instances until patching is confirmed complete.
- Run authenticated vulnerability scans against all TeamCity deployments to confirm exposure status.
Long-term improvements
- Maintain a continuously updated software asset inventory that flags when KEV-listed products are present in your environment.
- Establish an emergency patching SLA (e.g., 24–72 hours) for actively exploited, internet-facing vulnerabilities.
- Implement input validation and safe deserialization libraries as a secure development standard for all internal applications.
Detection measures
- Monitor TeamCity logs and network traffic for anomalous deserialization attempts or unexpected outbound connections.
- Subscribe to CISA KEV Catalog alerts and integrate them into your vulnerability management workflow for automated triage.
- Deploy endpoint detection and response (EDR) tooling on CI/CD servers to identify post-exploitation activity such as lateral movement or credential dumping.