The Australian Cyber Security Centre (ACSC) has issued an alert that a critical authentication bypass in JetBrains’ TeamCity on‑premises server is currently being exploited locally.
Active attacks target the CI platform
The flaw, catalogued as CVE-2026-63077, carries a severity rating of 9.8 out of 10. It enables anyone with HTTP or HTTPS access to run arbitrary operating‑system commands on the affected server.
According to the ACSC, attackers can leverage the vulnerability to tamper with build artifacts, alter pipeline state, and potentially harvest stored credentials.
JetBrains confirmed the issue in late July and urged users to apply the latest updates. The company warned that “depending on the privileges granted to the TeamCity server process, a successful attack could expose TeamCity data, configurations, and stored credentials, modify server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines.”
Initially the vendor said no exploit attempts had been observed. The ACSC’s latest notice indicates that situation has changed, though it offered no further details on the attacks.
Related: NSW to use facial recognition in gaming
Security researchers trace the cause
Rapid7’s analysis linked the problem to an overly permissive allow‑list governing which Java classes the server may deserialize from unauthenticated agent requests. The platform’s own protocol classes were added without first removing the default XStream library permissions, creating an unsafe deserialization path.
Researcher Stephen Fewer published proof‑of‑concept code on GitHub, demonstrating how the bypass can be triggered.
The United States Cybersecurity and Infrastructure Security Agency (CISA) has placed the vulnerability in its Known Exploited Vulnerabilities (KEV) catalogue, marking it as a must‑fix item for affected organizations.
JetBrains also released patches this month for a critical flaw in its YouTrack product (CVE‑2026‑75045, severity 9.1) that could allow unauthenticated download of database backups. Earlier in July, the company disclosed two separate 10/10‑severity bugs in IntelliJ IDEA affecting remote sessions.
- CVE-2026-63077 – authentication bypass, severity 9.8/10
- CVE-2026-75045 – YouTrack backup exposure, severity 9.1/10
- CVE-2026-64812 and CVE-2026-64813 – IntelliJ IDEA remote session flaws, severity 10/10 each
Authorities continue to track exploitation activity, and organizations are advised to stay informed through official advisories such as the ACSC and CISA notices.
