[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fx600fPcziXFNcT1u0LaULSqP30fN02utNBpINlbDaz4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":56},"eba9f4ce-222f-4696-af9d-7719c763096f","critical-teamcity-auth-bypass-enables-remote-code-execution","bd72d329-a1d7-44c3-ab2c-fe17db37eaaf","Critical TeamCity Auth Bypass Enables Remote Code Execution","A critical authentication bypass vulnerability (CVE-2026-63077) in JetBrains TeamCity On-Premises allows any attacker with HTTPS access to circumvent authentication entirely and execute arbitrary commands with server-level privileges — no credentials required. This is especially dangerous because TeamCity is a CI\u002FCD platform, meaning a compromised server can be weaponized to inject malicious code into build pipelines and software supply chains. The root cause reflects a failure in secure authentication design combined with delayed patching exposure for on-premises users. Organizations running unpatched versions remain fully exposed until upgrades or plugin patches are applied, highlighting the critical importance of rapid response to vendor security advisories.","**Immediate actions:**\n- Upgrade all TeamCity On-Premises instances to version 2025.11.7 or 2026.1.3 immediately, or apply the vendor-supplied security patch plugin if upgrading is not yet possible.\n- Restrict HTTPS access to TeamCity servers by placing them behind a VPN or firewall, limiting exposure to trusted IP ranges only.\n- Audit TeamCity server logs for any suspicious authentication attempts or unexpected command execution activity that may indicate prior exploitation.\n\n**Long-term improvements:**\n- Maintain a complete, up-to-date inventory of all on-premises software versions to ensure timely identification of vulnerable systems when advisories are published.\n- Establish a formal emergency patching SLA (e.g., 24–48 hours) for critical-severity vulnerabilities affecting internet-facing or build infrastructure systems.\n- Implement network segmentation to isolate CI\u002FCD infrastructure from production environments, limiting blast radius in the event of a compromise.\n\n**Detection measures:**\n- Deploy a vulnerability management tool that continuously monitors for newly disclosed CVEs affecting your software inventory and triggers automated alerts.\n- Enable centralized logging and SIEM alerting for anomalous TeamCity activity, including unexpected process spawning or privilege escalation events.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-3: Access Enforcement","NIST IA-2: Identification and Authentication","NIST SA-11: Developer Testing and Evaluation (Supply Chain context)","ITIL Change Management: Emergency Change Procedure","OWASP A07:2021 – Identification and Authentication Failures",{},"published","2026-07-31T00:20:56.206795+00:00","2026-07-31T00:20:55.888+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fjetbrains-warns-of-critical-teamcity-remote-code-execution-flaw\u002F","jetbrains-warns-of-critical-teamcity-remote-code-execution-flaw-d7e6c8","JetBrains warns of critical TeamCity remote code execution flaw",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[50],{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"0ae5760a-f459-41b0-9bbb-a5b44ae3b44c","2026-07-31","morning","ThreatNoir Morning Brief — July 31","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-07-31\u002Fthreatnoir-morning-brief-2026-07-31.mp3",[57,61,64],{"slug":58,"name":59,"problem":60},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",{"slug":34,"name":62,"problem":63},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":46,"name":65,"problem":66},"Automated patch management","Known holes get closed in days, not months."]