[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0Tyf79LglVAxJ-atFlCIQ3fVw5HoDnI1fnTl5BQKSXI":3,"$fjFlzt7oTi4rLf6SzaXaqsli5nHhxLg9rtFcHgc0aYYo":53},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":49,"created_at":50,"updated_at":51,"published_at":52},"jetbrains-teamcity-rce-cve-2026-63077-exposed-via-runzero-asset-discovery","JetBrains TeamCity RCE (CVE-2026-63077) Exposed via RunZero Asset Discovery","Unauthenticated RCE on TeamCity Server via CVE-2023-42793, CVSS 9.8, EPSS 100%, KEV-listed, PoC public.","JetBrains TeamCity On-Premises before 2023.05.4 has an authentication bypass (CWE-288) that lets an unauthenticated remote attacker execute arbitrary code on the server, enabling supply-chain compromise of CI\u002FCD builds.",[10,11,12,13,14,15],"JetBrains","TeamCity","CVE-2023-42793","RCE","CI\u002FCD","RunZero","# JetBrains TeamCity RCE (CVE-2026-63077) Exposed via RunZero Asset Discovery\n\n*Unauthenticated RCE on TeamCity Server via CVE-2023-42793, CVSS 9.8, EPSS 100%, KEV-listed, PoC public.*\n\n**Tags:** `JetBrains` `TeamCity` `CVE-2023-42793` `RCE` `CI\u002FCD` `RunZero`\n\n> JetBrains TeamCity On-Premises before 2023.05.4 has an authentication bypass (CWE-288) that lets an unauthenticated remote attacker execute arbitrary code on the server, enabling supply-chain compromise of CI\u002FCD builds.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2023-42793 | 9.8 | 100.0% | ✅ listed | available | 90.5 (Critical) |\n\n## The TeamCity RCE that's being hammered\n\nCVE-2023-42793 is an unauthenticated remote code execution flaw in JetBrains TeamCity On-Premises, tracked as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). It carries a CVSS 3.1 score of 9.8 and an EPSS score of 100.0% (100th percentile), placing it in the top tier of actively exploited bugs. The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, and a public proof-of-concept is available.\n\nExploitation began in September 2023, shortly after JetBrains shipped the fix in TeamCity 2023.05.4 and Rapid7 published a public PoC. As of September 25, 2023, Rapid7 had not yet seen in-the-wild exploitation, but that changed quickly. The bug now has a global footprint: APT29 and several North Korea-backed APTs are hammering exposed TeamCity servers at scale, with the feds confirming the exploitation wave. The flaw affects TeamCity On-Premises versions 2023.05.3 and earlier, and an unauthenticated remote attacker can achieve RCE on the TeamCity Server.\n\n## How the flaw works\n\nThe flaw works by letting an attacker bypass TeamCity’s authentication check through an alternate path or channel, as classified under CWE-288. An unauthenticated remote attacker sends a crafted request over HTTPS to the TeamCity Server, which grants administrative privileges without a valid session. From there, the attacker achieves remote code execution on the server process.\n\nThe bug affects TeamCity On-Premises 2023.05.3 and earlier; JetBrains shipped the fix in 2023.05.4. Stefan Schiller of Sonar reported the vulnerability and noted that attackers can inject malicious code into the build process, compromising software releases for all downstream consumers. Rapid7 published a technical analysis with indicators of compromise, and Caitlin Condon, head of vulnerability research at Rapid7, confirmed that as of September 25, 2023, no public exploit code was available and no in-the-wild exploitation had been observed.\n\n## Who's exploiting it\n\nAPT29, the Cobalt Group, is the lead state actor exploiting CVE-2023-42793, with several North Korea-backed APTs following per Microsoft’s Threat Intelligence Center. The feds confirm the exploitation wave is hitting exposed TeamCity servers at scale, a pattern that typically signals a high-value target in the build pipeline.\n\nFortinet and Microsoft both flag the bug as a top-priority target for dev teams, recommending that both the TeamCity server and build agents be vetted for signs of compromise. JetBrains’s own advisory is more direct: it recommends removing any publicly accessible TeamCity server from the internet while teams patch and investigate for compromise.\n\n## RunZero asset discovery\n\nRunZero is the primary tool for mapping the blast radius. Security teams are using it to scan the internet for exposed TeamCity instances running the vulnerable version, which is critical before the APTs finish their sweep. The scanner identifies the TeamCity server by its characteristic HTTP response and version string, flagging instances that are still on 2023.05.3 or earlier.\n\nGreynoise is tracking a large number of IP addresses actively sending exploit attempts against CVE-2023-42793, confirming that the scanning is widespread and not just a few researchers poking at the same handful of servers. The IP distribution matches the pattern you see when APT29 and the North Korea groups are running their own scanning infrastructure in parallel with the public PoC.\n\n## Why it's a supply-chain nightmare\n\nTeamCity is a CI\u002FCD server, so the RCE isn’t just a web app compromise — it’s control over the build process itself. An attacker who lands on the server can inject malicious code into the build pipeline, which means every artifact that server produces from that point on is potentially tainted. That’s the SolarWinds-style nightmare: one compromised server poisons every downstream release it builds, and the blast radius extends to every consumer pulling from that TeamCity instance.\n\nThe CVSS 9.8 (CVSS 3.1) and EPSS 100.0% (100th percentile) put this in the top tier for unauthenticated RCEs. It’s in CISA’s KEV list, and a public PoC is out, so the window for unpatched servers is short. PRS rates it 90.5, which is Critical territory.\n\n## Key points\n\n- CVE-2023-42793 is an authentication bypass (CWE-288) in TeamCity On-Premises ≤ 2023.05.3, fixed in 2023.05.4.\n- CVSS 3.1 score 9.8, EPSS 100.0% (100th percentile), CISA KEV-listed, Rapid7 PoC public.\n- Unauthenticated remote attacker achieves RCE on TeamCity Server, enabling build-agent code injection and downstream supply-chain compromise.\n- RunZero asset discovery surfacesing exposed TeamCity instances; exploitation via HTTPS bypasses auth to gain admin.\n- JetBrains recommends removing public servers from the internet during patching and compromise investigation.\n\n## Further reading & sources\n\n- [JetBrains TeamCity vulnerability: how to find impacted assets](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fjetbrains-teamcity) — RunZero\n- [Global TeamCity Exploitation Opens Door to SolarWinds-Style Nightmare](https:\u002F\u002Fwww.darkreading.com\u002Fvulnerabilities-threats\u002Fglobal-teamcity-exploitation-opens-door-to-solarwinds-style-nightmare)\n- [Critical JetBrains TeamCity vulnerability could be exploited to launch supply chain attacks (CVE-2023-42793) - Help Net Security](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2023\u002F09\u002F26\u002Fcve-2023-42793\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fjetbrains-teamcity-rce-cve-2026-63077-exposed-via-runzero-asset-discovery.png?v=e72ab95e44",{"cves":19,"actors":34,"timeline":42,"technologies":47},[20,28],{"id":12,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},true,"\u002Fvulnerabilities\u002FCVE-2023-42793",9.8,0.9999,"Critical",90.5,"3.1",{"id":29,"kev":21,"poc":30,"url":31,"cvss":23,"epss":32,"risk_band":25,"risk_score":33,"cvss_version":27},"CVE-2026-63077",false,"\u002Fvulnerabilities\u002FCVE-2026-63077",0.8957,89.78,[35],{"url":36,"name":37,"slug":38,"type":39,"origin":40,"motivation":41},"\u002Fthreat-groups\u002Fapt29","APT29","apt29","apt","Russia (SVR)","espionage",[43],{"date":44,"event":45,"description":46},"2023-09-01","Exploit start","APT29 starts exploiting CVE-2023-42793 after JetBrains patches and Rapid7 releases PoC",[48],{"vendor":10,"product":11},"vulnerability_disclosure","2026-09-12T07:13:03.260727+00:00","2026-10-16T12:28:43.279822+00:00",null,{"articles":54},[55,66,78,89],{"slug":56,"title":57,"summary":58,"tags":59,"hero_image_url":64,"story_type":49,"created_at":65},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-Able N-Central RCE with 3-day federal deadline","CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.",[60,61,62,13,63],"CVE-2026-18556","N-Able N-Central","CISA KEV","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","2026-09-21T12:03:34.769619+00:00",{"slug":67,"title":68,"summary":69,"tags":70,"hero_image_url":76,"story_type":49,"created_at":77},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004: Unauthenticated Attackers Execute Shell Commands via diffpatch","Gitea disclosed CVE-2026-60004, a critical remote code execution vulnerability in the diffpatch feature that allows unauthenticated remote attackers to write malicious Git hooks and execute arbitrary shell commands as the Gitea process user on default installations with open self-registration enabled.",[71,72,13,73,74,75],"Gitea","CVE-2026-60004","diffpatch","Git hooks","CVSS 9.8","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81","2026-09-12T12:07:21.883073+00:00",{"slug":79,"title":80,"summary":81,"tags":82,"hero_image_url":86,"story_type":87,"created_at":88},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Shadowserver found 274 internet-facing Zimbra Collaboration Suite servers compromised in-the-wild via CVE-2026-73570, an unauthenticated OS command injection in the zimbra-snmp package that lets attackers execute arbitrary commands as the zimbra user via crafted SMTP requests.",[83,84,13,62,85],"Zimbra","CVE-2026-73570","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","exploitation","2026-09-24T07:12:41.74195+00:00",{"slug":90,"title":91,"summary":92,"tags":93,"hero_image_url":99,"story_type":100,"created_at":101},"greynoise-labs-reveals-34k-sessions-scanning-ivanti-connect-secure-for-cve-2025-","GreyNoise Labs reveals 34k+ sessions scanning Ivanti Connect Secure for CVE-2025-0282","Two parallel reconnaissance campaigns are scanning internet-facing Ivanti Connect Secure instances for CVE-2025-0282, with the high-volume cluster concentrated in AS213790 (Limited Network LTD) and the second campaign distributed across ~6,000 unique IPs.",[94,95,96,97,98,13],"Ivanti Connect Secure","CVE-2025-0282","GreyNoise Labs","AS213790","Limited Network LTD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgreynoise-labs-reveals-34k-sessions-scanning-ivanti-connect-secure-for-cve-2025-.png?v=ea7577722f","campaign","2026-09-14T07:09:53.792428+00:00"]