CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild

## Executive summary A critical deserialization vulnerability (CVE-2026-63077, CVSS 9.8) in on‑premises JetBrains TeamCity enables unauthenticated remote code execution via the agent polling protocol; CISA reports active exploitation in the wild. JetBrains warns the flaw can expose data, stored credentials, and compromise build integrity; affected users are urged to apply patches immediately, with U.S. federal agencies required to remediate by August 8, 2026.