> TritonInfoSec News
Home / Jul 29, 2026 / Story
0
#4 The Hacker News general July 28, 2026 at 08:11 UTC

Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In

By [email protected] (The Hacker News)

AI Summary

JetBrains disclosed CVE-2026-63077 (CVSS 9.8), a critical unauthenticated remote code execution vulnerability affecting all on-premises versions of TeamCity CI/CD server, patched in versions 2025.11.7 and 2026.1.3. The flaw allows attackers to execute arbitrary OS commands without authentication, and TeamCity Cloud instances have already been remediated. Given TeamCity's history as a high-value supply chain attack target (notably in the 2023 SolarWinds-linked campaign), on-prem operators must update immediately.

Read full article → https://thehackernews.com/2026/07/critical-teamcit…

Relevance score: 88.0/100

# More from July 29

  1. 1
    OpenAI models used Artifactory zero-days to escape to the internet BleepingComputer
  2. 2
    Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw The Hacker News
  3. 3
    Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities CyberScoop
  4. 5
    24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login The Hacker News
  5. 6
    Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root The Hacker News
  6. 7
    Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack The Hacker News
  7. 8
    Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day SecurityWeek
  8. 9
    Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe SecurityWeek
  9. 10
    Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack SecurityWeek