Blog · 2-hour update · 2026-10-24

CVE-2026-63077 Jetbrains Teamcity: exploited in ransomware attacks, patch now

On 24 October 2026, 16 new CVEs were published that we track: 1 critical, 5 already exploited in the wild (CISA KEV) and 0 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.

What happened in this 2-hour window: the most serious item is CVE-2026-63077 in teamcity (critical, CVSS 9.8, priority 99/100). Recommended action: upgrade to 2025.11.7, 2026.1.3. 5 new CVEs from the list below are already being exploited (CVE-2026-63077, CVE-2026-16232, CVE-2026-16812, and more), so those go first. 5 of the 8 top items can be attacked remotely without a login. At least one is linked to ransomware campaigns. 0 of 16 new CVEs already have a fix or vendor patch; for the other 16, follow the downgrade or mitigation steps until one ships.

Patch these first

CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Critical severity (CVSS 9.8), priority 99/100 (patch now). Signals: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: upgrade to 2025.11.7, 2026.1.3 for jetbrains teamcity.

References: NVD · Vendor Advisory

CVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability

Critical severity (CVSS 9.8), priority 94/100 (patch now). Signals: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: upgrade to r81.20 for checkpoint multi-domain security management.

References: NVD · Mitigation, Patch

CVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

Critical severity (CVSS 10.0), priority 81/100 (patch now). Signals: critical severity; exploited in the wild (cisa kev); remotely exploitable, no login, no user action. Recommended action: upgrade to 5.2.3.14, 6.1.3.4, 6.4.2.4 for arista velocloud orchestrator.

References: NVD · Mitigation, Vendor Advisory

CVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

Medium severity (CVSS 5.3), priority 78/100 (patch now). Signals: epss top 2%: very likely to be exploited; exploited in the wild (cisa kev); used in ransomware campaigns. Recommended action: upgrade to newer than 10.0.1 for cisco secure firewall management center.

References: NVD · Vendor Advisory

CVE-2026-42016: JFrog Artifactory Incorrect Authorization Vulnerability

High severity (CVSS 8.1), priority 77/100 (patch now). Signals: high severity; epss top 5%: very likely to be exploited; exploited in the wild (cisa kev). Recommended action: upgrade to 7.133.11 for jfrog artifactory.

References: NVD · Vendor Advisory

CVE-2026-115932: When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk,

Critical severity (CVSS 9.6), priority 34/100 (patch this month). Signals: critical severity. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116014: open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps

High severity (CVSS 8.1), priority 33/100 (routine). Signals: high severity; remotely exploitable, no login, no user action. Recommended action: apply the vendor mitigation.

References: NVD

CVE-2026-116019: Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitr

High severity (CVSS 8.8), priority 31/100 (routine). Signals: high severity. Recommended action: apply the vendor mitigation.

References: NVD

How to act on this list

1. Start with anything marked exploited or patch now.
2. Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
3. Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
4. Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.

FAQ

What is the most serious vulnerability published on 24 October 2026?

CVE-2026-63077 (JetBrains TeamCity Deserialization of Untrusted Data Vulnerability) ranks highest, with a priority score of 99/100. Recommended action: upgrade to 2025.11.7, 2026.1.3.

Are any of the new CVEs exploited in the wild?

Yes, 5 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.

Should I downgrade if there is no fix yet?

Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.

Sources

• NIST National Vulnerability Database: CVE details and affected versions
• CVE Program: official CVE records
• CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
• FIRST EPSS: exploit probability
• Distribution and vendor advisories linked under each item.

← All posts