Stephen Fewer

@stephenfewer · Twitter · 2026-08-07 15:47 UTC

We have published our @rapid7 analysis of CVE-2026-63077, an unauth RCE in JetBrains TeamCity that was disclosed last week and already added to KEV as being exploited in the wild. Check out our full analysis, IOCs, and PoC. This one has a gnarly gadget chain and a polygot SQL/JSP