JetBrains TeamCity CVE-2026-63077 Actively Exploited in the Wild, JPCERT Urges Immediate Patching and Breach Investigation
JetBrains has released security updates for its continuous integration product TeamCity after a critical vulnerability CVE-2026-63077 was found to be actively exploited in the wild.
The issue stems from unsafe deserialization of untrusted data via the agent polling protocol, enabling remote attackers to execute arbitrary code without authentication. JetBrains received the private report on July 10, 2026, and disclosed the flaw on July 27, shipping fixes in TeamCity 2026.1.3 and 2025.11.7.
Exploitation activity was subsequently observed, leading the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the vulnerability to its Known Exploited Vulnerabilities Catalog on August 5 and require federal agencies to apply mitigations by August 8. JetBrains issued its own exploitation advisory on August 7.
The JPCERT Coordination Center confirmed that vulnerable versions of the on-premises TeamCity product are running in Japan. Public exploit code for the remote code execution flaw is now available, increasing the risk of further attacks.
JPCERT/CC strongly recommends that organizations immediately identify their deployed versions, apply the available patches without delay, and consider conducting forensic investigations for signs of compromise.
Related articles
CISA Adds Seven Exploited Vulnerabilities in SonicWall, JFrog and Kestra to KEV Catalog
The US Cybersecurity and Infrastructure Security Agency has added seven known exploited vulnerabilities affecting SonicWall SMA1000, JFrog Artifactory and Kestra OSS products to its KEV catalog. Five of the flaws carry a three-day remediation deadline for federal agencies. Two issues in SonicWall SMA1000 enable unauthenticated server-side request forgery and authenticated OS command execution. A critical authentication bypass in JFrog Artifactory allows remote attackers to obtain administrative privileges. Kestra OSS is affected by an OS command injection vulnerability that can lead to full system compromise. CISA urges immediate patching and incident response actions.
Cisco Issues Security Updates for IOS XR Fixing Multiple Critical Vulnerabilities
Cisco Systems has released security updates for its network operating system Cisco IOS XR to address multiple vulnerabilities discovered through internal research. The update, published on September 2, 2026, classifies the flaws into seven categories, each assigned distinct CVE identifiers. Two vulnerabilities, CVE-2026-20274 and CVE-2026-20279, received the highest CVSS v3.1 base score of 9.8 and are rated Critical. Additional issues include command injection flaws rated 8.8 and other weaknesses scoring between 8.2 and 8.6. No exploitation has been observed at the time of disclosure. Cisco is distributing Software Maintenance Updates and plans to include fixes in upcoming releases 26.3.1 and 26.2.2.
Telegram Desktop Bug Deletes Up to 800 GB of User Data on Windows Due to Spellcheck Library Error
A critical configuration flaw in Telegram Desktop for Windows caused the application to recursively delete the entire contents of the C:\custom directory, resulting in the loss of approximately 800 GB of user data including programs, projects, and personal files. The issue originated in the lib_spellcheck library introduced in version 7.1.0, where an empty working directory path was concatenated with /custom and resolved by Qt into an absolute system path. Instead of locating a dictionary file, the code invoked removeRecursively() on the discovered directory, systematically erasing all accessible files while leaving folder structures intact. The bug affected only Windows builds with the built-in spellchecker enabled and remained in distribution for roughly 66 hours across versions 7.1.0 and 7.1.1. Researchers confirmed the behavior using Process Monitor logs and reported it via ticket #31170, prompting developers to add path validation before the function call and disable dictionary operations on empty paths. The corrected code was released in Telegram Desktop 7.1.2, and users running the vulnerable versions are advised to update immediately. No impact was observed on Linux or macOS platforms.
Essential Active Directory Checks Before Launching Any Penetration Test
Internal penetration tests of Active Directory can quickly generate noise in logs or disrupt services if techniques are applied without proper context. The article stresses that testers must first map domain boundaries, identify controllers, clarify allowed segments, and establish escalation procedures with the client. Detailed inventory of user, service, and privileged accounts is required, including analysis of Kerberos pre-authentication settings that enable AS-REP Roasting. Testers should also examine DACL permissions, delegation relationships, and Active Directory Certificate Services templates before attempting any exploitation. The guidance covers NTLM relay risks, the importance of maintaining an action log, and the distinction between standard pentests and Red Team engagements. A demo version of the Red September course on Active Directory attacks is offered to practice these steps in a controlled environment.