Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
2026-08-10T07:23:38Z•b60a52dc7568bef6efd1e1368c7d0aab330a64146c7bc1f0fffabbb63db59427
CVE-2026-18556CVE-2026-18577CVE-2026-63077CVE-2026-66066Active-StorageCISA-KEVJetBrains-TeamCityMSPN-able-N-centralRMMRuby-on-Railsarbitrary-file-readauthentication-bypassexploitation-in-the-wildlibvipsremote-code-executionunauthenticatedunsafe-deserializationvulnerability
What happened
Rapid7 reports multiple high-impact vulnerabilities in widely deployed platforms. CVE-2026-63077 is an unauthenticated unsafe deserialization flaw in JetBrains TeamCity enabling remote OS command execution and has been added to CISA KEV. CVE-2026-18577 is an authentication bypass in N-able N-central, exploited in the wild, potentially granting administrative control over RMM-managed environments. CVE-2026-66066 is a critical unauthenticated arbitrary file-read vulnerability in Ruby on Rails Active Storage when using libvips with untrusted uploads; exposed secrets may enable remote code ️ ️exec
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- b60a52dc7568bef6efd1e1368c7d0aab330a64146c7bc1f0fffabbb63db59427
- Enrichment time
- 2026-08-10T07:23:38Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.