Cyber

What changed

On July 27, 2026, JetBrains issued a security advisory regarding CVE-2026-63077, a critical vulnerability in TeamCity related to unsafe deserialization of untrusted data. This flaw allows attackers to exploit the agent polling protocol over HTTP or HTTPS, enabling them to execute operating system commands with the privileges of the TeamCity server process.

Who is affected

The vulnerability affects organizations using JetBrains TeamCity, particularly those with exposed servers accessible over the internet. Although JetBrains reported no known active exploitation at the time of disclosure, the situation changed when CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on August 5, 2026.

• JetBrains TeamCity users with internet-facing servers.
• Organizations relying on CI/CD pipelines that utilize TeamCity.
• Development teams using JetBrains products in their workflows.
• IT departments managing JetBrains TeamCity installations.

What to do

It is imperative for affected organizations to assess their exposure to this vulnerability and take immediate action to mitigate risks. JetBrains has likely provided patches or workarounds that should be implemented as soon as possible.

• Review JetBrains' security advisory for CVE-2026-63077 for detailed guidance.
• Apply any available patches to TeamCity installations promptly.
• Restrict access to TeamCity servers to trusted networks only.
• Monitor for any unusual activity or unauthorized access attempts.

What changed

A serious OS command injection vulnerability has been discovered in the Arista VeloCloud Orchestrator (VCO) On-Prem version. This flaw could enable remote attackers to access privileged internal functionalities, posing a risk to the orchestrator's host system.

The vulnerability threatens the confidentiality, integrity, and availability of both the orchestrator and the data it manages. It is critical to note that this functionality was designed for internal use and should not be accessible remotely.

Who is affected

The vulnerability impacts users of the Arista VeloCloud Orchestrator, specifically those utilizing the On-Prem version.

Both the Hosted and Dedicated versions of VCO have been patched prior to this disclosure.

• Arista Networks - Vendor responsible for VeloCloud Orchestrator.
• Organizations using the On-Prem version of VCO.
• IT departments managing network orchestration tools.
• Any entity relying on VCO for data management and orchestration.

What to do

Immediate action is required to mitigate the risks associated with this vulnerability. Users of the affected VCO version should ensure they are running the latest patched version.

It is advisable to review security configurations and restrict access to the orchestrator to prevent unauthorized exploitation.

• Update to the latest version of Arista VeloCloud Orchestrator.
• Implement strict access controls to the orchestrator.
• Monitor network traffic for any signs of exploitation attempts.
• Stay informed on further updates from Arista regarding this vulnerability.