Australia Alerts to Active Exploitation of Critical TeamCity Server Vulnerabilities

Key Takeaways

• The Australian Cyber Security Centre (ACSC) has warned that threat actors are actively exploiting a critical vulnerability (CVE 2026-63077) in all versions of TeamCity On‑Premises.
• The flaw allows unauthenticated attackers with HTTP(S) access to bypass authentication and execute arbitrary OS commands, carrying a CVSS score of 9.8.
• No specific industry is singled out, but every Australian organization using TeamCity On‑Premises is at risk.
• Immediate actions urged by ACSC and JetBrains include: reviewing networks for vulnerable instances, applying the latest patches (TeamCity 2025.11.7 or 2026.1.3) or installing the security‑patch plugin, and reconsidering whether the TeamCity interface needs to be exposed to the internet.
• The vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog on August 5, 2026, following evidence of active exploitation, and JetBrains issued a follow‑up advisory two days later.
• Historical context shows that TeamCity has been a repeated target; similar flaws were heavily exploited in 2024, and a 2023 vulnerability was leveraged by Russian and North Korean nation‑state actors.
• Securing CI/CD pipelines is essential: organizations should adopt continuous vulnerability monitoring, network segmentation, and least‑privilege access controls to mitigate future risks.

Overview of the Threat
The Australian Cyber Security Centre (ACSC) issued an urgent alert stating that malicious actors are actively exploiting a critical vulnerability affecting TeamCity On‑Premises servers. The vulnerability, identified as CVE 2026-63077, permits unauthenticated attackers who can reach the server via HTTP(S) to bypass authentication mechanisms and execute arbitrary commands on the underlying operating system. Because the flaw impacts every released version of the On‑Premises product, any organization that has not applied the latest mitigations is potentially exposed to full system compromise. The ACSC emphasized that, while no particular industry or sector appears to be singled out in the current campaign, all Australian entities utilizing TeamCity On‑Premises must treat the situation as a high‑priority security incident.

Technical Details of CVE 2026-63077
CVE 2026-63077 carries a CVSS v3.1 base score of 9.8, reflecting its critical nature. The vulnerability resides in the authentication checks of the TeamCity web interface, allowing an attacker to craft a specially formed request that tricks the server into skipping validation steps. Once authentication is bypassed, the attacker can invoke arbitrary functionality exposed by the server’s API, ultimately leading to remote code execution (RCE) with the privileges of the TeamCity service account. This level of access enables the installation of malware, data exfiltration, lateral movement within the network, or the creation of persistent backdoors. The flaw does not require any prior credentials, making it especially dangerous for servers exposed to the internet or accessible from untrusted network segments.

Impact on Australian Organizations
According to the ACSC, there is currently no evidence indicating that a specific industry—such as finance, health, or defense—is being targeted more heavily than others. Nevertheless, the agency warned that all Australian organizations that run TeamCity On‑Premises are at risk of compromise if they have not mitigated the vulnerability. The broad impact stems from the widespread adoption of TeamCity as a CI/CD platform across sectors; a successful breach could disrupt software development pipelines, compromise source code repositories, and facilitate supply‑chain attacks that affect downstream customers and partners. The ACSC’s advisory serves as a reminder that even widely used internal tools can become high‑value targets when critical flaws remain unpatched.

Recommended Mitigation Steps
The ACSC and JetBrains outline a concise set of actions for affected entities:

1. Asset Discovery – Conduct a thorough inventory of all TeamCity On‑Premises instances within the network, paying particular attention to those reachable from the internet or from segmented zones that may be less tightly controlled.
2. Patch Application – Upgrade to TeamCity version 2025.11.7 or 2026.1.3, which contain the fixes for CVE 2026-63077. If upgrading is not immediately feasible, install the official security‑patch plugin provided by JetBrains for the affected version.
3. Network Exposure Review – Evaluate whether the TeamCity web interface needs to be publicly accessible. Where possible, restrict access to trusted IP ranges, place the server behind a VPN or zero‑trust gateway, and enforce strong authentication mechanisms such as multi‑factor authentication (MFA) for administrative accounts.
4. Monitoring and Logging – Enable detailed audit logs, monitor for anomalous authentication attempts or unexpected command executions, and integrate logs with a Security Information and Event Management (SIEM) system for rapid detection.
5. Incident Response Preparedness – Ensure that playbooks for responding to suspected compromise of CI/CD servers are up to date, including steps for isolating the host, collecting forensic evidence, and rotating any credentials or tokens stored within TeamCity.

Background on TeamCity
TeamCity is a widely deployed Continuous Integration and Continuous Deployment (CI/CD) server developed by JetBrains. It automates the build, test, and release processes for software projects, allowing development teams to integrate code changes frequently and deliver updates with greater reliability. Organizations use TeamCity to orchestrate complex pipelines that may involve compiling code, running unit and integration tests, performing static analysis, packaging artifacts, and deploying to staging or production environments. Because the server often has direct access to source code repositories, build artifacts, and deployment credentials, a compromise can have cascading effects across an organization’s software supply chain. Its popularity—spanning thousands of enterprises worldwide—makes it an attractive target for attackers seeking to infiltrate development environments.

Timeline of Disclosure and Exploitation
JetBrains first disclosed CVE 2026-63077 in July 2026, accompanied by the release of patched versions and a security‑patch plugin. The vulnerability was subsequently added to the U.S. Cybersecurity and Infrastructure Agency’s (CISA) Known Exploited Vulnerabilities (KEV) Catalog on August 5, 2026, after telemetry confirmed active exploitation in the wild. CISA highlighted that such flaws are a frequent attack vector for malicious cyber actors and pose significant risks to federal enterprises. Two days after the KEV entry, JetBrains issued a follow‑up advisory, noting that they had received reports of both successful exploitation attempts and unsuccessful probing against unpatched TeamCity servers, reinforcing the urgency for customers to apply the mitigations without delay.

Patch Versions and Plugin
To remediate CVE 2026-63077, organizations must either upgrade to TeamCity 2025.11.7 or 2026.1.3, which incorporate the necessary code changes, or apply the security‑patch plugin designed for older, still‑supported releases. JetBrains advises that the plugin provides the same protection as the full version upgrades and can be deployed with minimal disruption to existing pipelines. Administrators should verify the integrity of the plugin package, follow the vendor’s installation guide, and restart the TeamCity service after application to ensure the fixes are active.

Historical Context
The current incident is not isolated; TeamCity has been a repeated target of threat actors. In 2024, two distinct vulnerabilities affecting TeamCity On‑Premises were reported as being extensively exploited, with the most severe allowing unauthenticated remote compromise of the entire server. The following year, a critical flaw disclosed in 2023 was observed being leveraged by Russian and North Korean nation‑state actors, underscoring the appeal of CI/CD infrastructure to advanced persistent threats (APTs). These patterns illustrate that attackers view build servers as high‑value stepping stones: gaining control can enable manipulation of source code, insertion of malicious binaries into software releases, and the potential to impact thousands of downstream users.

Broader Implications for CI/CD Security
The exploitation of CVE 2026-63077 reinforces the necessity of treating CI/CD platforms as critical assets worthy of the same defensive rigor applied to production systems. Recommendations derived from this event include:

• Zero‑Trust Principles – Assume that no network segment is inherently trustworthy; enforce strict identity verification and least‑privilege access for all interactions with TeamCity.
• Continuous Vulnerability Management – Integrate automated scanning tools that check for known vulnerabilities in CI/CD components and trigger patching workflows upon detection.
• Supply‑Chain Awareness – Maintain an inventory of third‑party plugins and extensions used within TeamCity, assessing them for security risks before deployment.
• Incident Detection & Response – Deploy behavioral analytics to detect abnormal command execution or atypical API usage patterns that may indicate post‑exploitation activity.
• Segregation of Duties – Separate the build environment from production deployment environments, limiting the lateral movement potential of a compromised CI/CD server.

Conclusion and Call to Action
The ACSC’s warning about active exploitation of CVE 2026-63077 serves as a stark reminder that even widely trusted development tools can become entry points for cyber adversaries when left unpatched. Australian organizations—and indeed any entity running TeamCity On‑Premises—must act promptly to inventory their assets, apply the required patches or security plugin, restrict unnecessary internet exposure, and enhance monitoring and incident‑response capabilities. By doing so, they not only mitigate the immediate threat posed by this vulnerability but also strengthen the overall resilience of their CI/CD pipelines against future attacks. In an era where software supply chain integrity is paramount, securing the build server is no longer optional; it is a fundamental component of a robust cybersecurity posture.