Australia Warns of Hackers Exploiting TeamCity Flaw, PoC Public

Attackers are actively targeting JetBrains TeamCity servers in the wild. The TeamCity CVE-2026-63077 vulnerability allows unauthenticated remote code execution. Australia’s ACSC confirms active exploitation, and Rapid7 has published a full analysis plus proof-of-concept exploit code.

TL;DR

CVE-2026-63077 lets an unauthenticated attacker run OS commands on a TeamCity On-Premises server. ASD’s ACSC observed active exploitation in Australia. A public proof-of-concept now exists, and CISA added the flaw to its KEV catalog.

Why It Matters

TeamCity sits at the heart of CI/CD pipelines. It builds, tests, and ships software. A single breach therefore threatens the whole software supply chain.

A successful exploit can expose stored credentials and configurations. Worse, attackers can tamper with build artifacts. That poisons every downstream deployment.

How the Attack Works

The flaw abuses the TeamCity agent polling protocol. An attacker with HTTP(S) access bypasses authentication checks. From there, they run commands with the server process privileges.

Rapid7 Labs confirmed a reliable path to code execution. Their write-up describes a script that writes a malicious file, triggers execution, then cleans up. Details in JetBrains’ official CVE-2026-63077 update guide administrators toward fixed builds.

Affected Versions

This vulnerability affects all TeamCity On-Premises versions. ASD’s ACSC found no evidence that any single sector is being singled out.

Patch and Mitigation Steps

Patch as soon as practicable. Apply the security patch plugin or upgrade to a fixed version.

Also reduce your exposure. Review whether the interface must stay internet-facing. Additionally, hunt logs for ConversionException messages and check unauthorized build agents named with a “scan” prefix. Australia’s ACSC published a detailed advisory on the active exploitation with further guidance.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.