Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
2026-08-09T19:23:39Z•59b439d44056957214b0a4d8325c3c25f668140a4402ed1580e3197765b2f7f3
CVE-2026-18556CVE-2026-18577CVE-2026-63077CVE-2026-66066Active StorageCISA KEVJetBrains TeamCityN-able N-centralRMMRuby on Railsactive-exploitationarbitrary-file-readauthentication-bypassexploitlibvipsremote-code-executionunsafe-deserializationvulnerability
What happened
Rapid7 reports multiple serious vulnerabilities disclosed or analyzed in August 2026. CVE-2026-63077 enables unauthenticated remote code execution against JetBrains TeamCity through unsafe XStream deserialization and has confirmed in-the-wild exploitation after CISA KEV listing. CVE-2026-18577 is an authentication bypass in N-able N-central, also exploited in the wild, potentially granting administrative control over RMM infrastructure and downstream managed systems. CVE-2026-66066 affects Ruby on Rails Active Storage applications using libvips, allowing unauthenticated arbitrary file reads of
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 59b439d44056957214b0a4d8325c3c25f668140a4402ed1580e3197765b2f7f3
- Enrichment time
- 2026-08-09T19:23:39Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.