Active exploitation • TeamCity On-Premises
Australia’s cyber agency says it has observed active exploitation of CVE-2026-63077 against TeamCity On-Premises servers within Australia. The critical flaw can let an unauthenticated attacker with HTTP or HTTPS access execute operating-system commands as the TeamCity server process. Organizations running the on-premises product should verify their version, patch immediately and preserve evidence if compromise is suspected.[1][2]
Actively exploited
Observed within Australia; global victim count unknown.[1]
CVSS 9.8 Critical
Unauthenticated remote code execution.[5]
2025.11.7 or 2026.1.3
Vendor patch plugin available for 2017.1 and later.[3]
Neither Australia’s alert nor the vendor’s public guidance identifies a threat actor, victim organization, campaign size, confirmed data theft, downstream software tampering or ransomware involvement. CISA’s KEV record lists known ransomware-campaign use as Unknown.[1][4]
What changed
The vulnerability itself is not new. JetBrains disclosed CVE-2026-63077 on July 27 and released fixes. CISA added it to the Known Exploited Vulnerabilities catalog on August 5, and JetBrains said on August 7 that it had received reports of active and attempted exploitation targeting unpatched servers.[2][3][4]
The material update is geographic corroboration: the Australian Signals Directorate’s Australian Cyber Security Centre published a high-status alert on August 24 saying it had observed active exploitation within Australia. The agency said it had no information indicating a specific industry or sector was being targeted.[1]
Who is affected—and who is not
The affected product is TeamCity On-Premises when it has not received the vendor’s fix or security patch. JetBrains says the flaw is reachable when a vulnerable TeamCity server is accessible over HTTP or HTTPS. TeamCity Cloud customers do not need to take action because JetBrains says the necessary mitigations were already applied.[2][3]
This is not a general Windows, Microsoft 365, Google Workspace or consumer-device vulnerability. It matters most to organizations that run software-development infrastructure, and to businesses whose MSP or enterprise IT provider operates TeamCity on their behalf.
| Environment | Action | Evidence boundary |
|---|---|---|
| TeamCity On-Premises below the fixed releases | Update to 2025.11.7, 2026.1.3 or a later vendor-supported fixed release.[3] |
Potentially vulnerable when reachable over HTTP(S).[3] |
| TeamCity 2017.1 or later when immediate upgrade is impossible | Use JetBrains’ security patch plugin as a temporary CVE-specific measure, then plan a full upgrade.[2] | The plugin addresses this CVE only.[2] |
| TeamCity Cloud | No customer action for this vulnerability.[2] | Vendor says mitigations were already applied.[2] |
Why a build server compromise matters
JetBrains says successful exploitation can expose TeamCity data, configurations and stored credentials, change server state and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines. Those are documented capabilities—not proof that every observed intrusion produced each outcome.[2]
That distinction matters. TeamCity often sits near source code, signing processes, package publishing and deployment credentials. Practical risk therefore depends on the privileges and secrets available to the TeamCity service and on how the surrounding pipeline is segmented.
Patch now, but do not erase evidence
- Inventory TeamCity On-Premises servers, including instances operated by an MSP or enterprise provider.
- Record the installed version and current exposure before making changes.
- If compromise is suspected, involve the incident-response lead and preserve relevant server logs, unauthorized-agent records, system timelines and volatile evidence before rebuilding or deleting artifacts.
- Upgrade to a fixed release. If a full upgrade is temporarily impossible, use only JetBrains’ documented security patch plugin and keep the full upgrade on the plan.[2][3]
- Restrict external access where practical and review the vendor’s investigation guidance. Patching closes the known entry point; it does not establish that a previously exposed server is clean.[2][3]
- Coordinate evidence collection, containment and credential rotation with the incident-response lead; do not delay credential revocation when active misuse is suspected.[1][2]
JetBrains says one conversion-error log message may indicate an attempted or successful exploit but does not confirm exploitation by itself. It also describes a different blocked-attempt message that can appear after patching. Treat indicators as investigation leads, not automatic proof of compromise.[2]
The federal deadline is historical—not a private-sector timer
CISA added CVE-2026-63077 to KEV on August 5 with an August 8 due date. That date applies within the relevant federal directive scope; it is not a universal private-sector legal deadline. For everyone else, KEV status is strong risk-prioritization evidence, while vendor guidance and the organization’s own exposure and incident-response obligations control the operational response.[4]
What remains unknown
- How many TeamCity servers were successfully compromised.
- Whether the Australian activity represents one campaign or several unrelated operations.
- Who is responsible or what their objectives were.
- Whether any U.S., Florida or Treasure Coast organization was affected.
- Whether observed access led to credential theft, persistent access, altered builds, downstream compromise or ransomware.
The absence of public answers does not reduce the patching priority. It does set a ceiling on responsible reporting: known exploitation is confirmed; campaign scale and impact are not.
Bottom line for local organizations
If your business does not run TeamCity On-Premises—and no IT provider runs it for you—this alert likely does not apply. If it does, verify ownership and version immediately, patch through the vendor-supported path, reassess internet exposure and investigate suspicious activity without destroying evidence.
The Australian alert adds credible geographic confirmation to an exploitation story that JetBrains and CISA had already escalated. It does not identify a victim, actor or global campaign count.[1][2]
Sources
- Australian Cyber Security Centre — Active exploitation of a software development platform within Australia
- JetBrains — Additional guidance following reports of active exploitation
- JetBrains — Critical security issue affecting TeamCity On-Premises
- CISA — Known Exploited Vulnerabilities catalog JSON feed
- NVD — CVE-2026-63077
Reporting cutoff: August 26, 2026, 7:21 PM EDT / 2026-08-26T23:21:46Z. This article reports public evidence available by that cutoff and does not include exploit instructions.