Infosec News Nuggets — August 11, 2026
Brief
CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild
A deserialization flaw in on-premise JetBrains TeamCity servers is being actively exploited, letting unauthenticated attackers bypass authentication via the agent polling protocol and run arbitrary commands with the privileges of the TeamCity server process. Successful attacks can expose stored credentials and configurations and compromise the integrity of downstream CI/CD build pipelines.
Federal civilian agencies were given until August 8 to patch under CISA’s binding directive, and a follow-up technical analysis published August 7 detailed how a permissive deserialization allowlist in vulnerable versions enabled the bug.