TeamCity Under Active Attack in Australia: What Businesses and IT Providers Need to Do Now

Weekly Cybersecurity Update — 31 August 2026

Australian organisations using JetBrains TeamCity On-Premises need to act. On 24 August 2026, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) issued a High alert after observing active exploitation in Australia of CVE-2026-63077, a critical vulnerability affecting TeamCity On-Premises servers.

This is more than a theoretical software vulnerability. JetBrains has also confirmed that its own Cadence cloud-development service was exploited through the same TeamCity vulnerability. That incident created potential exposure of customer information, credentials and secrets used during Cadence executions.

For Australian businesses, this turns the story from “another critical CVE” into a practical lesson about patching, internet exposure, privileged systems, credential security and the software supply chain.

Why SwiftTech Selected This Topic This Week

This is one of the most important cybersecurity issues for Australian businesses this week for three reasons.

ASD’s ACSC has observed active exploitation within Australia.
The vulnerability may be exploited without authentication when a vulnerable TeamCity server is reachable over HTTP or HTTPS.
JetBrains has confirmed a real-world incident involving its Cadence service, showing the possible downstream consequences of a compromised CI/CD environment.

Even if your business does not operate TeamCity directly, your developer, software supplier, managed service provider or internal IT team may use CI/CD tools behind the scenes.

This is why organisations should treat privileged management and automation platforms as critical infrastructure. SwiftTech regularly recommends reviewing these systems as part of a broader business cybersecurity strategy.

What Is TeamCity?

JetBrains TeamCity is a Continuous Integration and Continuous Deployment platform, commonly referred to as a CI/CD platform.

Software development teams use CI/CD systems to automate tasks such as:

building software;
running automated tests;
accessing source-code repositories;
creating application packages;
deploying software into production environments; and
connecting development systems to cloud services and infrastructure.

A TeamCity server can therefore hold or access highly privileged information. Depending on how it is configured, it may connect to Git repositories, cloud environments, build agents, container registries, deployment systems, package repositories and production servers.

It may also store or use API tokens, SSH keys, deployment credentials and other secrets needed for automated workflows.

That level of access is why compromise of a CI/CD platform can have consequences far beyond one server.

What Happened With CVE-2026-63077?

According to JetBrains’ original security advisory , CVE-2026-63077 affects all TeamCity On-Premises versions.

An unauthenticated attacker who can reach a vulnerable TeamCity server over HTTP or HTTPS may be able to exploit the TeamCity agent polling protocol, bypass authentication checks and execute arbitrary operating-system commands with the privileges of the TeamCity server process.

JetBrains has fixed the vulnerability in:

TeamCity 2025.11.7; and
TeamCity 2026.1.3.

JetBrains also released a security patch plugin for TeamCity 2017.1 and later for organisations unable to upgrade immediately.

JetBrains subsequently reported active and attempted exploitation against unpatched TeamCity servers.

ASD’s ACSC then issued its High alert on 24 August after observing active exploitation within Australia.

TeamCity Cloud customers do not need to take action for this particular vulnerability, because JetBrains says the necessary mitigations have already been applied to the cloud service.

The Cadence Incident Shows the Possible Blast Radius

On 28 August, JetBrains confirmed a separate security incident affecting JetBrains Cadence .

Cadence used TeamCity to orchestrate workloads, and JetBrains confirmed that the affected Cadence environment was vulnerable to CVE-2026-63077 and was exploited through it.

JetBrains identified malicious activity between 8 August and 24 August 2026 and took the affected Cadence server offline on 24 August.

JetBrains also acknowledged that the server should have been patched as part of its response to the TeamCity vulnerability but had not been.

Affected users were advised to revoke or rotate credentials and secrets that may have been used during Cadence executions. Examples identified by JetBrains included:

AWS, Microsoft Azure and Google Cloud credentials;
GitHub, GitLab and Bitbucket tokens;
package repository credentials;
container registry credentials;
API tokens;
SSH and deployment keys;
service accounts;
Slack tokens and webhooks; and
signing keys or certificates.

Those details relate specifically to the Cadence incident, not every TeamCity installation. However, they demonstrate how compromise of a trusted build platform can expand into cloud services, repositories, deployment environments and other connected systems.

Why This Matters to Australian Small and Medium Businesses

Many small-business owners will never personally log in to TeamCity. That does not mean the vulnerability is irrelevant.

Your website developer may use TeamCity. A software company providing your business applications may use it. Your managed IT provider or internal development team may rely on a CI/CD platform to automate deployment and maintenance.

If one of these trusted platforms is compromised, attackers may gain access to systems that your business relies on.

Potential business impacts include:

theft of credentials, API tokens or deployment keys;
unauthorised access to source code and intellectual property;
malicious changes to software builds;
access to cloud systems and storage;
compromise of package or container registries;
service interruptions while systems are investigated and rebuilt;
data loss or exposure; and
reputational, contractual or regulatory consequences.

This is why privileged platforms need strong access controls, monitoring, patch management and recovery planning. These controls also form part of the principles behind the Essential Eight security framework.

What Australian Organisations Should Do Now

1. Confirm Whether TeamCity On-Premises Is in Use

Ask your internal IT team, developer, software supplier or managed service provider whether TeamCity On-Premises is used anywhere within your environment or supply chain.

If TeamCity is managed by a third party, ASD’s ACSC recommends contacting that provider to confirm that the platform has been patched and monitored for suspicious activity.

2. Patch Immediately

Upgrade TeamCity to 2025.11.7, 2026.1.3 or a later secure version.

If an immediate upgrade is not possible, JetBrains provides a security patch plugin for TeamCity 2017.1 and later.

However, organisations should not use the plugin as a reason to postpone normal platform upgrades indefinitely, because newer versions may contain additional security fixes.

3. Reduce Internet Exposure

Review whether the TeamCity administration interface needs to be reachable directly from the public internet.

Where practical, organisations should consider controls such as:

firewall restrictions;
trusted IP allow-lists;
VPN access;
reverse-proxy protections;
network segmentation; and
dedicated management networks.

SwiftTech can assist businesses with network infrastructure and security reviews to identify unnecessary internet exposure.

4. Check for Signs of Exploitation

Installing the patch prevents the known vulnerability from being exploited in the same way, but it does not prove that a previously exposed server was never compromised.

Organisations should review:

TeamCity logs;
operating-system activity;
unexpected commands or processes;
new administrator or service accounts;
unusual build configuration changes;
repository activity;
unusual outbound network connections; and
vendor-provided indicators of compromise.

JetBrains has also published additional guidance about unauthorised TeamCity agents .

JetBrains notes that patched servers may still show agents with names such as scan-<random digits> when automated scanners attempt exploitation. Those entries do not automatically prove successful compromise.

5. Review Connected Systems and Credentials

If exploitation is suspected or confirmed, the investigation should not stop with the TeamCity server.

Review systems connected to TeamCity, including:

source-code repositories;
cloud accounts;
deployment environments;
package repositories;
container registries;
service accounts; and
API integrations.

Potentially exposed credentials, tokens and keys should be rotated.

Look for unexpected repository clones, new commits, unusual webhooks, newly created access tokens, changes to cloud IAM permissions or unexpected service accounts.

6. Apply Least Privilege

CI/CD platforms should never hold more privilege than necessary.

Use separate service accounts, short-lived credentials where possible and narrowly scoped permissions. Administrative accounts should be protected with strong authentication controls and monitored closely.

The same principle applies to Microsoft 365, cloud services and business administration platforms. SwiftTech provides cybersecurity reviews that can help identify excessive administrative access.

7. Strengthen Monitoring

Security monitoring should include both the TeamCity server itself and the systems it can reach.

Centralised logging, endpoint detection and response, alerting and privileged-account monitoring can help identify suspicious activity before it develops into a larger incident.

8. Maintain Protected and Tested Backups

Backups do not prevent exploitation, but they can significantly reduce the business impact of destructive activity.

Maintain multiple copies of important information, keep at least one backup protected from normal administrative access and regularly test recovery.

SwiftTech provides business backup and data protection solutions designed to support recovery after cyber incidents, hardware failures and other disruptions.

The Bigger Lesson: Protect Trusted IT Platforms Like Critical Infrastructure

TeamCity is not the only type of platform that may have powerful access across a business environment.

Other high-value targets include:

remote monitoring and management platforms;
Microsoft 365 administrator accounts;
backup consoles;
cloud-management portals;
firewalls;
virtualisation systems;
CI/CD platforms; and
identity-management systems.

Attackers understand that compromising one trusted management layer may provide access to many other systems.

The practical security model is therefore consistent: patch quickly, minimise internet exposure, enforce least privilege, monitor privileged activity, protect credentials and maintain tested recovery options.

Questions to Ask Your IT Provider Today

Do we use TeamCity On-Premises directly or through a third party?
Is TeamCity running version 2025.11.7, 2026.1.3 or a later secure version?
Was the server exposed to the internet while unpatched?
Have TeamCity logs and vendor indicators of compromise been reviewed?
Have connected repositories, cloud services and deployment systems been checked?
Are service accounts and API credentials restricted using least privilege?
If compromise is suspected, have exposed credentials and tokens been rotated?
Are endpoint monitoring, logging and tested backups in place?

How SwiftTech Can Help

If you are unsure whether your business, developer or IT provider uses TeamCity — or you want a broader review of privileged systems, Microsoft 365, backups, networking or external exposure — SwiftTech can help.

Our services include:

business IT support and managed services;
cybersecurity assessments and protection;
Microsoft 365 security and administration;
patch management and endpoint protection;
backup and disaster recovery;
network and infrastructure security; and
security and exposure reviews.

A practical security review can identify exposed services, outdated systems, over-privileged accounts, weak backup arrangements and other issues before they become a serious incident.

Contact SwiftTech to discuss a cybersecurity or IT security review for your business.

Frequently Asked Questions

Is CVE-2026-63077 being exploited in Australia?

Yes. ASD’s ACSC said on 24 August 2026 that it had observed active exploitation of CVE-2026-63077 affecting TeamCity On-Premises servers within Australia.

Which TeamCity versions are affected?

JetBrains says all TeamCity On-Premises versions are affected. The vulnerability is fixed in TeamCity 2025.11.7 and 2026.1.3, with a security patch plugin available for TeamCity 2017.1 and later.

Does TeamCity Cloud Need to Be Patched?

JetBrains says TeamCity Cloud customers do not need to take action for CVE-2026-63077 because the required mitigations have already been applied.

Does Installing the Patch Prove the Server Was Never Compromised?

No. If a TeamCity server was accessible from the internet while unpatched, the organisation should still review logs, indicators of compromise and connected systems.

What Should I Do if I Think TeamCity Was Compromised?

Isolate and investigate the affected environment, review TeamCity and operating-system logs, assess connected systems, rotate potentially exposed credentials and tokens, and seek professional incident-response assistance where appropriate.

Australian organisations can also contact ASD’s ACSC via 1300 CYBER1 (1300 292 371).

TeamCity CVE-2026-63077 Actively Exploited in Australia | SwiftTech