teamcity vulnerabilities and fixes

Recent CVEs affecting teamcity, with upgrade or downgrade steps. 2 tracked.

teamcity has 2 tracked vulnerabilities, 1 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 2. Most recent: 2026-07-27. Highest priority: CVE-2026-63077 (score 100/100).

• CVE-2026-63077 CRITICAL 9.8 EXPLOITED UPGRADE JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
• CVE-2026-65906 HIGH 8.8 UPGRADE In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible

FAQ

How do I fix teamcity vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is teamcity being exploited right now?

Yes: 1 teamcity CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which teamcity CVE should I patch first?

CVE-2026-63077 currently ranks highest (100/100): JetBrains TeamCity Deserialization of Untrusted Data Vulnerability.

← Back to latest CVEs