[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-63077":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-22T20:44:10.849Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":24,"aliases":25,"duplicate_of":9,"upstream":26,"downstream":27,"duplicates":28,"related":29,"reserved_at":9,"published_at":30,"modified_at":31,"state":32,"summary":33,"references_raw":44,"kevs":57,"epss":68,"epss_history":71,"metrics":148,"affected":155},"CVE-2026-63077","In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-502","Deserialization of Untrusted Data","The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.","weakness","Draft","Base","Medium",[20],{"id":21,"name":22,"techniques":23},"CAPEC-586","Object Injection",[],[],[],[],[],[],[],"2026-07-27T16:44:32.290Z","2026-08-06T03:55:21.297Z","Analyzed",{"cisa_kev":34,"cisa_ransomware":35,"cisa_vendor":36,"epss_severity":37,"epss_score":38,"severity":39,"severity_score":40,"severity_version":41,"severity_source":42,"severity_vector":43,"severity_status":32},true,false,"JetBrains","medium",0.10722,"critical",9.8,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",[45,51],{"url":46,"sources":47,"tags":49},"https://www.jetbrains.com/privacy-security/issues-fixed/",[42,48],"nvd",[50],"Vendor Advisory",{"url":52,"sources":53,"tags":54},"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077",[42,48],[55,56],"Government Resource","US Government Resource",[58],{"source":59,"vendor":36,"product":60,"date_added":61,"vulnerability_name":62,"short_description":63,"required_action":64,"due_date":65,"known_ransomware_campaign_use":66,"notes":67,"exploitation_type":9},"cisa","TeamCity","2026-08-05","JetBrains TeamCity Deserialization of Untrusted Data Vulnerability","JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","2026-08-08","Unknown","https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/; https://www.jetbrains.com/privacy-security/issues-fixed/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63077",{"date":69,"score":38,"percentile":70},"2026-08-22",0.95473,[72,76,79,82,85,88,91,94,97,99,103,106,108,111,114,117,120,123,126,129,132,135,138,141,144,147],{"date":73,"score":74,"percentile":75},"2026-07-28",0.00649,0.4738,{"date":77,"score":74,"percentile":78},"2026-07-29",0.47409,{"date":80,"score":74,"percentile":81},"2026-07-30",0.4749,{"date":83,"score":74,"percentile":84},"2026-07-31",0.47523,{"date":86,"score":74,"percentile":87},"2026-08-01",0.47534,{"date":89,"score":74,"percentile":90},"2026-08-02",0.47543,{"date":92,"score":74,"percentile":93},"2026-08-03",0.47554,{"date":95,"score":74,"percentile":96},"2026-08-04",0.47564,{"date":61,"score":74,"percentile":98},0.47585,{"date":100,"score":101,"percentile":102},"2026-08-06",0.0101,0.59783,{"date":104,"score":101,"percentile":105},"2026-08-07",0.59827,{"date":65,"score":101,"percentile":107},0.59839,{"date":109,"score":101,"percentile":110},"2026-08-09",0.59837,{"date":112,"score":38,"percentile":113},"2026-08-10",0.95389,{"date":115,"score":38,"percentile":116},"2026-08-11",0.95396,{"date":118,"score":38,"percentile":119},"2026-08-12",0.95408,{"date":121,"score":38,"percentile":122},"2026-08-13",0.95412,{"date":124,"score":38,"percentile":125},"2026-08-14",0.95418,{"date":127,"score":38,"percentile":128},"2026-08-15",0.95428,{"date":130,"score":38,"percentile":131},"2026-08-16",0.95431,{"date":133,"score":38,"percentile":134},"2026-08-17",0.95432,{"date":136,"score":38,"percentile":137},"2026-08-18",0.95435,{"date":139,"score":38,"percentile":140},"2026-08-19",0.95454,{"date":142,"score":38,"percentile":143},"2026-08-20",0.95464,{"date":145,"score":38,"percentile":146},"2026-08-21",0.9547,{"date":69,"score":38,"percentile":70},[149,153],{"source":42,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":150,"cvss_v4_0":9},{"baseScore":40,"baseSeverity":151,"vectorString":43,"impactScore":40,"exploitabilityScore":152},"CRITICAL",10,{"source":48,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":154,"cvss_v4_0":9},{"baseScore":40,"baseSeverity":151,"vectorString":43,"impactScore":40,"exploitabilityScore":152},[156],{"ecosystem":9,"name":60,"vendor":157,"product":158,"cpe_part":159,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":160},"jetbrains","teamcity","a",[161,165,169],{"version":162,"is_range":34,"range_type":42,"version_start":9,"version_start_type":9,"version_end":163,"version_end_type":164,"fixed_in":9},"\u003C 2026.1.3, 2025.11.7","2026.1.3, 2025.11.7","excluding",{"version":166,"is_range":34,"range_type":167,"version_start":9,"version_start_type":9,"version_end":168,"version_end_type":164,"fixed_in":9},"lt2025.11.7","cpe","2025.11.7",{"version":170,"is_range":34,"range_type":167,"version_start":171,"version_start_type":172,"version_end":173,"version_end_type":164,"fixed_in":9},"gte2026.1_lt2026.1.3","2026.1","including","2026.1.3"]