Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-63077: JetBrains TeamCity unauthenticated RCE with public PoC and active exploitation

github.com | vulnerability | Critical | Actively exploited | CVE-2026-63077 | #active-exploitation | #rce | #public-poc | #featured | #jetbrains | #teamcity | #deserialization | #ci-cd | #poc | #cve-2026-63077

Summary

This public PoC demonstrates unauthenticated remote code execution in JetBrains TeamCity On-Premises through the agent polling protocol and unsafe deserialization. The issue affects TeamCity On-Premises; fixes are available in 2025.11.7 and 2026.1.3. CISA added the vulnerability to KEV on August 5, 2026, confirming active exploitation. The JetBrains-hosted TeamCity service is not affected.

Why it matters

An unauthenticated attacker who can reach a TeamCity HTTP(S) service may execute arbitrary operating-system commands with the TeamCity server process privileges, exposing configuration and credentials, changing server state, and compromising build artifacts or downstream CI/CD pipelines. CISA KEV now confirms active exploitation. Upgrade to 2025.11.7, 2026.1.3, or later immediately; if upgrading is not possible, apply JetBrains' security patch plugin, restrict internet access, rotate exposed credentials, and investigate potentially exposed instances.
CVE
CVE-2026-63077
Vendor
JetBrains
Product
TeamCity On-Premises
Affected versions
All TeamCity On-Premises versions; fixed in 2025.11.7 and 2026.1.3
CVSS
9.8
Published
Collected

original ↗

Related coverage

Critical · vulnerability · github.com
Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject
This PoC demonstrates an unexpected filter-bypass gadget in Log4j 2, emphasizing the danger of unauthenticated serialized object ingestion.
High · vulnerability · github.com
WordPress Core Unauthenticated Path Traversal to LFI & RCE PoC (CVE-2026-87902)
While remote code execution depends on runtime prerequisites like PEAR, the unauthenticated LFI primitive resides directly in WordPress Core and affects all major branches from 4.7.0 through 7.1.1.
Critical · vulnerability · github.com
CVE-2026-8452 PoC: Citrix NetScaler pre-auth RCE detection and exploitation
This is a public pre-auth remote-code-execution PoC, and although offsets are hardcoded for a specific build, it materially lowers the exploitation barrier. NetScaler administrators should upgrade affected builds per the Citrix bulletin and restrict exposed Gateway/AAA surfaces; use the PoC only in explicitly authorized isolated environments.
High · vulnerability · github.com
CVE-2026-66804 PoC: Windows Cross Device virtual camera local privilege escalation to SYSTEM
The PoC demonstrates a complete local privilege-escalation chain from a standard user to SYSTEM, and exploit code is now public. Affected Windows endpoints should install Microsoft's August 2026 security updates promptly. Reproduction plants a DLL in a system path and triggers a privileged service, so it should only be performed in an explicitly authorized, recoverable lab environment.
High · vulnerability · github.com
CVE-2026-68398 PoC: Ubuntu PPPoL2TP kernel UAF local privilege escalation
The PoC turns a kernel UAF into local privilege escalation from an ordinary user to root, making it relevant for authorized Linux kernel research and patch validation. The race can panic or corrupt a system, so it should only run in an isolated, recoverable lab VM and affected kernels should be updated.
High · vulnerability · github.com
CVE-2026-50656 PoC: Microsoft Defender RoguePlanet elevation-of-privilege patch bypass
The repository publishes a patch-bypass implementation for a Defender elevation-of-privilege flaw, increasing practical risk to affected endpoints. Administrators should update the Malware Protection Engine to a fixed version and validate the PoC only in an explicitly authorized isolated environment; public availability does not by itself confirm exploitation in the wild.
back