Daily Threat Briefing
← All briefings

JetBrains TeamCity

Date: 2026-08-10 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

Today’s primary new item is a Rapid7-published proof-of-concept for CVE-2026-63077 (JetBrains TeamCity unauthenticated RCE), providing full technical detail on the XStream deserialization gadget chain and concrete IOCs for detection — materially elevating the threat posture for any unpatched TeamCity instance. The CISA KEV deadline for CVE-2026-8037 (Progress LoadMaster) expires today. No new CISA KEV additions, BSI WID, or CERT-EU advisories were published in the last 24 hours.

Critical Vulnerabilities

CVE-2026-63077 — JetBrains TeamCity (Unauthenticated RCE via XStream Deserialization)

  • Severity: Critical (CVSS not specified; functionally equivalent to critical — unauthenticated RCE)
  • EPSS: Not yet scored; CISA KEV confirmed exploitation in the wild as of 2026-08-05
  • Technical detail: Rapid7 published a full analysis and public PoC on 2026-08-07. An unauthenticated attacker registers a fake agent via POST /app/agents/v1/register, obtains a session ID, then sends a crafted XStream XML gadget chain to POST /app/agents/v1/commands/error. The root cause is that TeamCity 2026.1.2’s XStreamHolder appends its allowlist on top of XStream’s default permissions (which include Map and Throwable hierarchies) rather than replacing them. The gadget chain pivots through HSQLMetadataStorage$SchemaMismatchException → BasicDataSource → FreeMarker HashAdapter → TiedMapEntry.hashCode() → BasicDataSource.getConnection(), which executes attacker-controlled HSQLDB SQL that writes a .jspws webshell into TeamCity’s webroot. A second HTTP request to the webshell achieves OS command execution. The patch (v2026.1.3) inserts NoTypePermission.NONE before the allowlist, blocking the chain at its first step.
  • Exploitation status: Confirmed in the wild (CISA KEV, 2026-08-05); public PoC now available.
  • IOCs: In teamcity-server.log, look for ForbiddenClassException or ConversionException referencing HSQLMetadataStorage$SchemaMismatchException on POST /app/agents/v1/commands/error from unexpected IPs. In teamcity-javaLogging-*.log, look for HsqlException referencing .jspws file paths. Scan webroot for random-hex-named .jspws files (e.g., 682aed03b49b.jspws).
  • Remediation: Upgrade to TeamCity 2026.1.3 immediately. If patching is not immediately possible, block external access to /app/agents/v1/ at the perimeter. Hunt for .jspws webshells in the TeamCity webroot and review server logs for the IOC patterns above.

ONGOING:

  • CVE-2026-8037 (Progress LoadMaster): CISA KEV deadline today (2026-08-10) — patch immediately; restrict management interface to trusted IPs.
  • CVE-2026-14526 (WordPress AI Copilot plugin): EPSS 0.61 — update beyond 1.5.6 or deactivate; patch still required.
  • Metabase SQL injection zero-day (CVE pending): Emergency patch available — apply; treat exposed instances as compromised.
  • CVE-2026-64638 (WordPress Core): Apply core patch; enforce CSP on login pages.
  • CVE-2026-64637 (Plesk): Upgrade to 18.0.80.1; enforce MFA.
  • CVE-2026-0257 (PAN-OS GlobalProtect): Qilin ransomware exploitation ongoing — patch immediately.
  • CVE-2026-16232 (Check Point SmartConsole): Actively exploited — treat unpatched instances as compromised.
  • CVE-2026-13505 / CVE-2026-8798 (Bouncy Castle FIPS): Upgrade BC-FJA to 1.0.2.7 / 2.0.2 / 2.1.3; prioritize regulated environments.
  • CVE-2026-71993 (MSI Radix AXE6600): No patch available — disable remote management; restrict to trusted LAN.
  • D-Link DWR-M961 (multiple CVEs): Update firmware to 1.1.5_C1_202607071108; restrict management access.

European Advisories

No new BSI WID or CERT-EU advisories were published in the last 24 hours.

Previously reported advisories remain actionable: WID-SEC-2026-2702 (Arista VeloCloud), WID-SEC-2026-2703 (Flowise, unpatched), WID-SEC-2026-2699 (Wazuh), WID-SEC-2026-2690 (Sophos Endpoint), WID-SEC-2026-2701 (WordPress), and the Microsoft/Google/Apache batch from 2026-08-07. See yesterday’s report for full details.

Active Threats and Campaigns

STATUS CHANGE — JetBrains TeamCity (CVE-2026-63077): Public PoC released by Rapid7 (2026-08-07) with full gadget chain documentation. This materially lowers the bar for exploitation. Any organization that has not yet patched should treat the instance as actively targeted. See Critical Vulnerabilities for IOCs and remediation.

ONGOING — N-able N-central (Hotfix 2): Threat actors continue evolving techniques against the RMM platform; apply Hotfix 2, audit managed endpoints for persistence.

ONGOING — Head Mare / TrueConf supply chain: Backdoored installers in circulation; verify installer hashes before deployment.

ONGOING — UNC6671 vishing (financial/professional services): No new developments; brief staff, enforce SaaS MFA.

ONGOING — Microsoft 365 AitM phishing (payroll/finance): No new developments; enforce Conditional Access, block legacy auth.

ONGOING — ~800 malicious npm packages (RAT/infostealer): Audit dependency trees; enforce lockfile integrity.

Security News and Context

  • TeamPCP threat actor: New analysis links TeamPCP to Redis attacks dating to 2020 and a subsequent software supply chain campaign, with overlapping infrastructure and malware deployment patterns. The Hacker News
  • Linux SCTP use-after-free (18-year-old flaw): Tencent researchers demonstrated root escalation and container escape; fixed in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148 (released 2026-08-03). The Hacker News
  • Keyv npm supply chain (Shai-Hulud worm): A supply chain attack on the popular keyv key-value library infected more than 440 npm packages. Heise Security
  1. JetBrains TeamCity (CVE-2026-63077): Upgrade to v2026.1.3 immediately; hunt for .jspws webshells in webroot; review server logs for IOC patterns detailed above. Public PoC is now available — exploitation attempts will increase.
  2. Progress LoadMaster (CVE-2026-8037): CISA KEV deadline is today — patch now without delay; restrict management interface to trusted IPs.
  3. Linux kernel (SCTP use-after-free): Update to stable kernel 7.1.6 / 6.18.42 / 6.12.101 / 6.6.148 on all Linux hosts, especially container hosts.
  4. keyv / npm supply chain (Shai-Hulud): Audit keyv and dependent npm packages in all Node.js environments; verify package integrity against known-good hashes.
  5. N-able N-central: Confirm Hotfix 2 is applied; continue auditing managed endpoints for lateral movement and new persistence mechanisms.
  6. Metabase zero-day: Confirm emergency patch is applied; treat any previously exposed instance as compromised and review query logs.
  7. Head Mare / TrueConf: Verify all TrueConf installer hashes against vendor-provided values; scan existing deployments for backdoor indicators.
  8. WordPress AI Copilot plugin (CVE-2026-14526): Confirm update or deactivation is complete; EPSS 0.61 indicates active exploitation risk.
  9. TeamPCP / Redis exposure: Review internet-facing Redis instances for unauthorized access; check for overlapping IOCs from the TeamPCP infrastructure analysis.
  10. Continue remediation of previously reported items: CVE-2026-64638 (WordPress Core), CVE-2026-64637 (Plesk), CVE-2026-0257 (PAN-OS), CVE-2026-16232 (Check Point), Bouncy Castle FIPS, MSI Radix AXE6600, D-Link DWR-M961, Wazuh, Arista VeloCloud, Flowise.