Unauthenticated remote code execution in JetBrains TeamCity On-Premises via the agent polling protocol. ASD's ACSC warned that the flaw is under active attack against TeamCity On-Premises servers in Australia, according to iTnews (25 Aug 2026). All On-Premises versions are affected. TeamCity Cloud is not.

Patch to 2025.11.7 or 2026.1.3, or apply the vendor security patch plugin if you cannot upgrade.

UPDATE 24 Sep 2026: BleepingComputer reports CISA updated the KEV entry for CVE-2026-63077 (already catalogued 5 Aug 2026) to flag ransomware-gang abuse — fourth TeamCity KEV item since Oct 2023 also tied to ransomware; Shadowserver ~160 internet-exposed unpatched hosts (down from ~700). (sources: ASD's ACSC advisory; as reported by iTnews; BleepingComputer)

Correction (24 Oct 2026): the ACSC's exploitation warning is now attributed through iTnews's report, because the ACSC page cannot be read from Cyberstack. (source: iTnews)