CISA Adds JetBrains TeamCity CVE-2026-63077 to Known Exploited Vulnerabilities Catalog After Active Attacks
US authorities have issued an urgent alert regarding active exploitation of a vulnerability in JetBrains TeamCity, a popular continuous integration and continuous deployment server used for automating software builds, testing, and deployments.
The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw, identified as CVE-2026-63077, to its Known Exploited Vulnerabilities (KEV) catalog on August 5, 2026. The vulnerability arises from the deserialization of untrusted data through the agent polling protocol, enabling remote attackers to execute arbitrary code without requiring authentication.
TeamCity serves as a central development support server that orchestrates build and release processes across many enterprise environments. Because the issue allows unauthenticated remote code execution, successful exploitation can lead to full compromise of the build infrastructure and potential supply-chain risks for downstream software releases.
In response to confirmed attacks, CISA has mandated that US federal agencies apply the vendor-provided mitigations no later than August 8, 2026. The agency also warned that the vulnerability is being actively exploited, meaning any organization using the product should treat the issue with high priority and verify their exposure immediately.
Related articles
Critical Vulnerabilities Patched in WHMCS Billing Software for Hosting Providers
WebPros International has disclosed two serious vulnerabilities in its WHMCS billing management platform used by hosting and cloud service providers. CVE-2026-67399 allows unauthenticated remote code execution through unsafe deserialization of untrusted data under specific conditions, potentially compromising the entire server environment and associated data. CVE-2026-67398 affects the 2CheckOut payment gateway module and stems from missing authorization checks, enabling attackers to retrieve sensitive customer information including names, addresses, emails, and phone numbers without authentication. HackerOne assigned CVSS v4.0 scores of 9.3 (Critical) to the first issue and 8.2 (High) to the second. WebPros released fixed versions WHMCS 9.0.8 and 8.13.7, and recommended disabling the 2CheckOut module as a temporary mitigation for the second flaw.
Cisco Releases Critical Patches for Exploited SQL Injection Flaw in Secure Email Gateway
Cisco Systems has issued security updates for Cisco Secure Email Gateway to address a critical SQL injection vulnerability tracked as CVE-2026-76461. The flaw stems from insufficient input validation during email parsing and allows unauthenticated remote attackers to execute arbitrary SQL commands. Successful exploitation can lead to root-level access on the underlying operating system, enabling full command execution. The vulnerability carries a CVSSv3.1 base score of 9.8 and is rated Critical. Cisco confirmed active exploitation of the issue in September 2026. Recommended fixes include upgrading to versions 16.5.0-780, 16.0.4-3021, or 15.5.5-0141, with strong preference given to the newest release.
Telegram Desktop HTML Export Flaw Allowed Stealthy JavaScript Injection into Chat History
Researchers at ExPatch identified a vulnerability in Telegram Desktop that enabled attackers to embed malicious JavaScript into exported HTML chat histories without user detection. The flaw stemmed from insufficient sanitization of button captions added by bots, allowing hidden scripts to execute when the HTML file was opened in a browser. Malicious messages could be forwarded into chats and remain dormant until export, potentially exfiltrating messages, sender names, and timestamps to attacker servers. The issue affected versions 4.15.1 through 6.9.3, with fixes released in beta 6.9.4 and stable version 7.0.1 on July 14. No in-the-wild exploitation was observed, though the attack required specific conditions including an unpatched export and JavaScript-enabled browser. Users are advised to re-export chats after updating or open old files with JavaScript disabled.
Critical MikroTik RouterOS Vulnerabilities Enable SSH Authentication Bypass and Privilege Escalation
Polish CERT disclosed three vulnerabilities in MikroTik routers, two of which have been actively exploited since at least September 2. The flaws, rated 9.2 on CVSS, affect devices with internet-facing SSH access and were discovered using OpenAI models GPT 5.5 Cyber and GPT 5.6 Sol followed by manual verification. CVE-2026-67276 allows authentication bypass when the attacker knows the username and public key module, while CVE-2026-86060 permits privilege escalation via usernames containing invalid characters. Their combination enables full device compromise. A third issue, CVE-2026-67277 rated 8.8, resides in the speed-test service and can cause denial of service. Patches are available in RouterOS versions 7.25beta3, 7.24.2, 7.23.4 and 6.49.21, and MikroTik added detection for prior compromise. Attacks began concurrently with patch release and leave distinctive log entries.