Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
2026-08-11T07:23:38Z•8bc5ba90139034e80a5dcfc39cf63a46dc777261fd3187d6a9477ac847bfee01
CVE-2026-18556CVE-2026-18577CVE-2026-63077CVE-2026-66066Active StorageCISA KEVJetBrains TeamCityMSPMalleable C2MetasploitN-able N-centralRMMRuby on RailsXStreamarbitrary file readauthentication bypassexploitation in the wildlibvipspossible RCEunauthenticated RCEunsafe deserialization
What happened
Rapid7 reports multiple serious cybersecurity developments, led by CVE-2026-63077, an unauthenticated unsafe Java deserialization flaw in JetBrains TeamCity enabling remote OS command execution, which CISA added to KEV after in-the-wild exploitation. The feed also covers CVE-2026-18577, an exploited unauthenticated authentication bypass in N-able N-central that can grant administrative control and enable downstream MSP/customer compromise; CVE-2026-66066, a critical Ruby on Rails Active Storage/libvips arbitrary file-read vulnerability with possible RCE; and Metasploit Pro 5.1 capabilities. CV
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 8bc5ba90139034e80a5dcfc39cf63a46dc777261fd3187d6a9477ac847bfee01
- Enrichment time
- 2026-08-11T07:23:38Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.