JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

CVE-2026-63077 Critical CVSS 9.8 In-The-Wild Exploited Ransomware Known
Beranda Advisories CVE-2026-63077

Ringkasan Kerentanan (Vulnerability Overview)

Rilis: 01 October 2026
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.

Tindakan Mitigasi yang Wajib Diterapkan (Required Action)

Instruksi Keamanan untuk Pengelola TI / OPD
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Seluruh pengelola server dan aplikasi di lingkungan OPD Kabupaten Ciamis diimbau untuk segera mengaudit perangkat terdampak dan mengaplikasikan patch sebelum batas waktu mitigasi.

Produk & Versi Terdampak

Produk Versi Basis Batas Terdampak Status Keamanan
TeamCity 0 2026.1.3, 2025.11.7 AFFECTED

Threat Intelligence Matrix

CVE Identifier
CVE-2026-63077
Vendor / Project JetBrains
Produk Terdampak TeamCity
Skor CVSS
9.8 / 10.0
Status Eksploitasi AKTIF (In-The-Wild)
Kampanye Ransomware Teridentifikasi (Known)
Automatable (Wormable) Unknown
Dampak Teknis Total
Sumber Intelijen CISA KEV

Butuh Pendampingan Mitigasi?

Tim Ciamiskab-CSIRT siap mendampingi verifikasi kerentanan dan langkah pengamanan aset digital OPD Anda.

Lapor ke CSIRT WhatsApp Hotline CSIRT
CSIRT Assistant
Halo 👋 Ada yang bisa saya bantu? Jika perlu, chat ini bisa diteruskan ke admin.
Scroll