CISA Flags JetBrains TeamCity Deserialization Flaw (CVE‑2026‑63077) as Actively Exploited Vulnerability
What It Is — CISA added CVE‑2026‑63077, a deserialization‑of‑untrusted‑data flaw in JetBrains TeamCity, to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability allows an attacker to supply crafted objects that, when deserialized, can lead to remote code execution on the CI/CD server.
Exploitability — The addition to the KEV catalog confirms active, real‑world exploitation. Public proof‑of‑concept code has been observed in the wild; the CVSS score is reported as 8.5 (High).
Affected Products — JetBrains TeamCity (all supported versions prior to the vendor‑released patch, see JetBrains advisory).
Why It Matters for Compliance & Audit Readiness
- Control Mapping: The flaw maps to SOC 2 CC6.1 (System Operations) and CC7.1 (Change Management); rapid remediation must be documented as evidence of effective controls.
- Continuous Evidence: Demonstrating that the vulnerability was patched and that remediation status is continuously monitored satisfies auditors’ demand for real‑time compliance proof.
- Risk‑Based Prioritization: BOD 26‑04 requires federal agencies—and by extension, many regulated enterprises—to prioritize KEV items; aligning your vulnerability‑management program with this guidance shows due diligence.
Recommended Actions
- Inventory every on‑premise or cloud‑hosted TeamCity instance.
- Apply JetBrains’ security patch for CVE‑2026‑63077 immediately.
- Update your asset inventory and change‑management records to reflect the remediation.
- Capture patch‑deployment logs and integrate them into your SOC 2 evidence repository (e.g., Verisq Control Mapping).
- Incorporate the KEV feed into your continuous‑vulnerability‑scanning pipeline to flag future high‑risk CVEs automatically.
Source: CISA Advisory – 2026‑08‑05