Unauthenticated remote code execution in JetBrains TeamCity On-Premises via the agent polling protocol. ASD's ACSC warned that the flaw is under active attack against TeamCity On-Premises servers in Australia, according to iTnews (25 Aug 2026). All On-Premises versions are affected. TeamCity Cloud is not.

Patch to 2025.11.7 or 2026.1.3, or apply the vendor security patch plugin if you cannot upgrade.

UPDATE 24 Sep 2026: BleepingComputer reports CISA updated the KEV entry for CVE-2026-63077 (already catalogued 5 Aug 2026) to flag ransomware-gang abuse — fourth TeamCity KEV item since Oct 2023 also tied to ransomware; Shadowserver ~160 internet-exposed unpatched hosts (down from ~700).

Primary: ACSC alert, as reported by iTnews; wire: BleepingComputer 24 Sep.

Correction (24 Oct 2026): the ACSC's exploitation warning is now attributed through iTnews's report, because the ACSC page cannot be read from this desk. (source: https://www.itnews.com.au/news/asd-warns-australian-teamcity-servers-under-attack-628400)