Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using TeamCity On-Premises
Incident: Discovery of a critical unauthenticated remote code execution vulnerability (CVE-2026-63077) in TeamCity.
Impact: Potential full server compromise, exposure of stored credentials, and unauthorized modification of build pipelines.
Attacker: Unidentified threat actors
Analysis: CVE-2026-63077 leverages a flaw in the agent polling protocol to bypass authentication entirely. This allows an unauthenticated attacker to execute arbitrary OS commands with the privileges of the server process. Given the CVSS score of 9.8, this presents a severe risk to organizations hosting their own CI/CD infrastructure.
Recommendations: Update to TeamCity versions 2025.11.7 or 2026.1.3 immediately.; Apply the security patch plugin for legacy versions 2017.1+ if a full update is not possible.; Restrict TeamCity server access via VPN or network segmentation to prevent direct internet exposure.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source