CVE-2026-63077

CVE-2026-63077 is a critical authentication-bypass vulnerability (CVSS 9.8) affecting all versions of JetBrains TeamCity On-Premises. ASD's Australian Cyber Security Centre (ACSC) has observed active exploitation within Australia: an unauthenticated attacker with HTTP(S) access can bypass authentication checks and execute arbitrary operating-system commands on the CI/CD server.

Vulnerability Details

Australian Context

The ACSC alert reports no specific industry or sector being targeted. TeamCity frequently sits in small development shops rather than enterprise SOCs, so the alert carries an SMB audience tag. Compromise of a TeamCity server can expose source code, build artifacts, deployment credentials and downstream production environments.

Mitigation

1. Review environments for vulnerable TeamCity On-Premises servers and question whether build interfaces need internet exposure at all
2. Apply vendor mitigations and hunt using the vendor IoCs provided with the alert
3. Check third-party and MSP-managed instances — the alert explicitly asks organisations to confirm their providers have patched and are monitoring

Source

• ASD's ACSC — Active Exploitation of a Software Development Platform Within Australia — 2026-08-24

Related

• Acsc Teamcity Active Exploitation Alert 2026 08 24 — ACSC alert incident note

Escalation — 25 September 2026: CISA flags ransomware use

On 24 September 2026 CISA updated the Known Exploited Vulnerabilities catalog to record CVE-2026-63077 as known to be used in ransomware campaigns, a material escalation of the August alert. Until now the exploitation in evidence was intrusion and command execution; the KEV update means the flaw now sits on the access path to encryption and extortion, not just to CI/CD compromise. CISA has not published details of the campaigns behind the flag.

Exposure is contracting but not closed: Shadowserver was tracking just over 160 TeamCity servers unpatched against the flaw as of the KEV update, down from an initial 700 internet-exposed vulnerable instances.

• Source article