CISA Adds JetBrains TeamCity CVE-2026-63077 to Known Exploited Vulnerabilities Catalog After Active Attacks
US authorities have issued an urgent alert regarding active exploitation of a vulnerability in JetBrains TeamCity, a popular continuous integration and continuous deployment server used for automating software builds, testing, and deployments.
The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw, identified as CVE-2026-63077, to its Known Exploited Vulnerabilities (KEV) catalog on August 5, 2026. The vulnerability arises from the deserialization of untrusted data through the agent polling protocol, enabling remote attackers to execute arbitrary code without requiring authentication.
TeamCity serves as a central development support server that orchestrates build and release processes across many enterprise environments. Because the issue allows unauthenticated remote code execution, successful exploitation can lead to full compromise of the build infrastructure and potential supply-chain risks for downstream software releases.
In response to confirmed attacks, CISA has mandated that US federal agencies apply the vendor-provided mitigations no later than August 8, 2026. The agency also warned that the vulnerability is being actively exploited, meaning any organization using the product should treat the issue with high priority and verify their exposure immediately.
Related articles
Critical Vulnerabilities Disclosed in NVIDIA Dynamo with Remote Attack Risks
NVIDIA has released a security advisory detailing multiple vulnerabilities affecting its Dynamo software for Linux, which provides multimodal data serving capabilities. A total of 15 CVEs were identified across different versions, with the most severe being CVE-2026-24254 rated at CVSS 9.8 as Critical due to an out-of-bounds write in multimodal serving topology that allows unauthenticated remote attacks. Additional high-severity issues include CVE-2026-24253, which can cause denial of service through out-of-bounds memory writes, and CVE-2026-47623, which stems from deserialization of untrusted data leading to potential denial of service or data tampering, both scoring 8.2. The advisory notes a possible inconsistency between the reported CVSS base score and vector string that may be corrected later. Patches have been made available, and users are urged to update immediately to mitigate the risks.
DLL Sideloading via version.dll in WinSCP: Search Order Exploitation, Rust Proxy and Payload Interception
WinSCP loads version.dll from its own directory because Windows searches for DLLs in a specific order starting with the application folder. Researchers demonstrated how to identify this library through the import table, Known DLLs exclusion, and Procmon monitoring to observe the loader attempting the AppDir path before falling back to SysWOW64. The same technique was recently used in campaigns targeting FileZilla via a fake domain and CPUID supply-chain compromises involving cryptbase.dll. A Rust-based proxy DLL forwards 14 exports via linker-level redirection while implementing three hijacked functions that trigger a MessageBox payload immediately upon WinSCP startup. The PoC was built for 32-bit WinSCP on Windows 11 using cargo and a generated .def file that adapts to x86 or x64 targets. This attack remains effective because version.dll is not listed in KnownDLLs and is directly imported by WinSCP, guaranteeing early execution before the main application window appears.
VK Introduces Security Gate: Internal AppSec Platform for Code, Dependency and Container Security
VK has detailed its internal Security Gate platform, which combines SAST, SCA, secret detection and container scanning to identify security issues across more than 40,000 repositories. The system applies custom prioritization rules, dynamic metadata analysis and an LLM-based triage module called VK Triage to reduce false positives and focus developer attention on exploitable findings. Security Gate integrates directly with corporate GitLab for automatic project onboarding, badge reporting and merge-request checks via the Fast Scanner service. It also monitors open-source dependencies for protestware, malware and reachable vulnerable methods, while supporting a wide range of languages including Python, Go, Java and Swift. Additional features include Jira linking, cross-branch triage, SBOM export and automated alerts through VK WorkSpace bots.
2.2 Million Line Vulnerability Report: What Happens After Discovery and How to Turn Findings Into Action
A massive vulnerability scan produced an 1,819-page report and a 2.2-million-row Excel file that exceeded spreadsheet limits, highlighting the gap between detection and remediation. The article explains that finding vulnerabilities accounts for only 10 percent of the work, while the remaining 90 percent involves prioritization, remediation, verification, and ensuring issues do not reappear. Research from BI.ZONE, Sber, Qualys, Cyentia Institute, Kenna Security, and Hadrian shows that organizations can typically remediate only one in ten open vulnerabilities per month and that Time-to-Exploit has dropped dramatically, with many edge-device flaws exploited on the day of disclosure. The piece stresses that continuous scanning, full infrastructure coverage including shadow IT, and separate high-frequency perimeter scans are essential because 85 percent of KEV-vulnerable assets remain unpatched at disclosure time. It recommends replacing bulky reports with concise, role-specific registries that answer four questions: what to do, where to do it, by when, and the consequences of inaction. Three legitimate outcomes for every vulnerability are outlined: patching, compensating controls, or formal risk acceptance with defined review dates, while false positives such as orphaned OpenSSL libraries must be cleaned rather than ignored.