CI/CD Supply Chain Threat: Australia's ACSC Warns of Active Exploitation of JetBrains TeamCity On-Premises Servers (CVE-2026-63077)
Executive Summary
The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) issued an urgent high-severity cybersecurity advisory on August 24–25, 2026, warning of active in-the-wild exploitation targeting on-premises JetBrains TeamCity Continuous Integration and Continuous Deployment (CI/CD) servers. Tracked as CVE-2026-63077 (CVSS 9.8), the critical vulnerability enables unauthenticated remote attackers with network reachability to TeamCity HTTP(S) web interfaces to bypass authentication checks and execute arbitrary operating system commands with full server privileges. Australian government agencies, defense contractors, and enterprise software teams are urged to apply vendor patches or emergency mitigation plugins immediately to prevent catastrophic software supply chain compromises.
Technical Breakdown of CVE-2026-63077
The vulnerability resides in the internal agent communication and XML data serialization routines of TeamCity On-Premises:
1. XML Deserialization in Build Agent Polling Handlers
The vulnerability stems from unsafe deserialization of untrusted network data:
* The Vulnerable Endpoint: TeamCity build servers expose an internal agent communication interface over standard HTTP/HTTPS ports to coordinate build tasks, test execution, and deployment artifacts with distributed build agents.
* Unauthenticated Deserialization Bypass: An unauthenticated attacker sending crafted HTTP POST requests containing serialized Java objects can exploit a flaw in the XML parsing pipeline (com.thoughtworks.xstream serialization handling).
* Arbitrary Remote Code Execution: By embedding malicious gadget chains within the XML payload, the attacker triggers immediate code execution upon deserialization, spawning shell processes with the privileges of the TeamCity service account (SYSTEM on Windows, teamcity / root on Linux).
2. Supply Chain Blast Radius & Production Network Takeover
Compromising a CI/CD server gives threat actors unprecedented control over an enterprise's software development lifecycle (SDLC):
* Source Code & Secret Harvesting: Attackers extract source code repositories, embedded database passwords, and cloud deployment credentials (e.g., AWS IAM keys, Kubernetes service tokens, GitHub tokens) stored in build environment variables.
* Malicious Build Tampering: Threat actors can silently modify build scripts (pom.xml, package.json, build.gradle), injecting persistent backdoors into compiled release packages before they are distributed to downstream customers.
Attribute
Detail
Affected Software
JetBrains TeamCity On-Premises (All versions prior to the security fix release)
Vulnerability Identifier
CVE-2026-63077
Vulnerability Class
Deserialization of Untrusted Data (CWE-502) / Authentication Bypass (CWE-287)
CVSS v3.1 Score
9.8 (Critical)
Advisory Authority
Australian Cyber Security Centre (ASD's ACSC) / Cyber.gov.au
Compliance Impact
ASD Essential Eight (Maturity Level 3), APRA CPS 234, ISO 27001
Why CI/CD Infrastructure Is the Ultimate High-Value Target
Continuous Integration and Continuous Deployment pipelines represent the operational backbone of modern digital enterprises. Unlike perimeter web servers that hold only public content, CI/CD platforms hold complete access to source code, private cryptographic signing keys, and automated production deployment pipelines.
Exposing CI/CD management interfaces directly to the public internet creates systemic supply chain risks that can compromise thousands of downstream software users.
Recommendations and Mitigations
DevOps engineers, infrastructure administrators, and security operations teams should execute the following emergency remediation protocol:
1. Apply JetBrains Security Update or Emergency Patch Plugin: Upgrade TeamCity On-Premises to the latest patched version immediately, or install JetBrains' official security patch plugin.
2. Remove TeamCity Servers from the Public Internet: Restrict TeamCity web interfaces (ports 80/443/8111) to internal management VPNs and trusted developer subnets; disable all direct internet ingress.
3. Rotate All CI/CD Secrets & Deployment Credentials: Invalidate and rotate all API keys, SSH private keys, cloud access tokens (AWS, Azure, GCP), and container registry credentials stored in TeamCity build configurations.
4. Conduct Forensic Build Pipeline Sweeps: Inspect recent build logs, agent execution histories, and artifact checksums for unrecognized external network connections or modified binary packages.