The Australian Cyber Security Centre (ACSC) has issued a warning regarding the active exploitation of a critical vulnerability, CVE-2026-63077, affecting TeamCity On-Premises servers. This flaw allows unauthenticated attackers with HTTP(S) access to a TeamCity server to bypass authentication and execute arbitrary operating system commands. All versions of TeamCity On-Premises are impacted.
While the ACSC has not identified specific industries or sectors being targeted, all Australian organizations using TeamCity On-Premises are considered at risk. The agency has urged customers to promptly review their networks for vulnerable versions, apply necessary patches, and evaluate whether their TeamCity interface needs to be exposed to the internet.
TeamCity, developed by JetBrains, is a widely used Continuous Integration and Continuous Deployment (CI/CD) server that automates software build, test, and deployment processes.
JetBrains initially disclosed CVE-2026-63077, which carries a critical CVSS score of 9.8, in July 2026, at which point patches were made available. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on August 5, citing evidence of active exploitation. CISA highlighted that such vulnerabilities are frequently targeted by malicious actors and pose significant risks to federal systems.
Two days later, JetBrains released a follow-up advisory confirming reports of both active and attempted exploitation against unpatched TeamCity servers. The company advised customers who have not yet updated to TeamCity 2025.11.7 or 2026.1.3, or installed the security patch plugin, to do so immediately.
This is not the first time TeamCity On-Premises software has been a target for attackers. In 2024, two other vulnerabilities affecting the software were reportedly exploited extensively, with one allowing for complete compromise by a remote unauthenticated attacker. Additionally, a critical vulnerability discovered in 2023 was found to have been exploited by state-sponsored actors from Russia and North Korea.
