[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":54,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":61,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":67,"vulnerability-29735":74},[4,15,21,27,33,39,44],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Network Scanner","compliance-pages-launch-network-scanner","Scheduled scans are the spine of every compliance framework. Are you audit-ready?","https:\u002F\u002Fpentest-tools.com\u002Fusage\u002Fcompliance",false,[11],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Get compliance evidence","secondary","compliance-pages-launch",{"title":16,"slug":17,"text":18,"link":8,"external":9,"targets":19,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Website Scanner","compliance-pages-launch-website-scanner","Authenticated web-app scans show up in SOC 2, NIS2, and CRA Annex I. See why this is crucial for the business.",[20],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner",{"title":22,"slug":23,"text":24,"link":8,"external":9,"targets":25,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Advanced Pentest Reporting","compliance-pages-launch-reporting","Editable DOCX. Immutable PDF. JSON for the GRC tool. See why these formats are on every auditor's checklist.",[26],"\u002Ffeatures\u002Fpentest-reporting",{"title":28,"slug":29,"text":30,"link":8,"external":9,"targets":31,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Integrations","compliance-pages-launch-integrations","Vanta, Jira, webhooks - they all route back to DORA, NIS2, SOC 2, ISO 27001, CRA. See why this is crucial for the business.",[32],"\u002Ffeatures\u002Fintegrations",{"title":34,"slug":35,"text":36,"link":8,"external":9,"targets":37,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Sniper","compliance-pages-launch-sniper","Five compliance framework pages now reference Sniper as the source of validated exploitability evidence. See them all.",[38],"\u002Fexploit-helpers\u002Fsniper",{"title":40,"slug":14,"text":41,"link":8,"external":9,"targets":42,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Homepage","Turn confirmed vulnerabilities into evidence your auditor accepts. Testing requirements for DORA, NIS2, SOC 2, ISO 27001, and CRA.",[43],"\u002F",{"title":45,"slug":46,"text":47,"link":48,"external":49,"targets":50,"cta":53,"variant":13,"campaign_id":46},"Office Hours #11 - Compliance cycle survey","office-hours-11","[Live Office Hours, Wed Sept 16] Continuous compliance evidence: from automated tools or tired humans?","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_FLMs2-vyQbCTB67guMJH-Q",true,[51,52],"\u002Finsights\u002Fcompliance-cycles-survey","\u002Finsights","Save your spot",["Island",55],{"key":56,"params":57,"result":59},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":58},"{}",{"head":60},{},["Island",62],{"key":63,"params":64,"result":65},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":58},{"head":66},{},["Island",68],{"key":69,"params":70,"result":72},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":71},"{\"text-color\":\"gray\"}",{"head":73},{},{"id":75,"detectable_with":76,"vuln_details":82,"vuln_id":106,"name":107,"published":108,"updated":108},29735,{"tool":77,"engine":80},{"id":78,"name":79},1,"Network Scanner",{"id":78,"name":81},"Sniper",{"id":75,"codename":83,"description":84,"severity":85,"risk_description":86,"public_description":87,"public_recommendation":88,"recommendation":89,"references":90,"cvssv3":95,"epss_score":96,"epss_percentile":97,"cve":98,"in_cisa_catalog":49,"date":100,"software_type":101,"vendor":102,"product":103,"ptt_exploit_capabilities":104},null,"We found that the target server is running JetBrains TeamCity On-Premises in a version older than 2026.1.3 or 2025.11.7, which is vulnerable to unauthenticated remote code execution through the agent polling protocol. The endpoints under \u002Fapp\u002Fagents\u002Fv1\u002F are reachable without authentication and deserialize attacker-supplied XML using XStream. The root cause is that XStreamHolder.setupSecurityIfNeeded() applies its allowlist without first clearing XStream's default type permissions with NoTypePermission.NONE, so the permissive defaults covering the Map and Throwable hierarchies remain in effect and the allowlist is additive rather than exclusive. After registering an agent session on \u002Fapp\u002Fagents\u002Fv1\u002Fregister, an attacker can post a crafted object graph to \u002Fapp\u002Fagents\u002Fv1\u002Fcommands\u002Ferror that chains a TeamCity exception class, a FreeMarker bean wrapper and a TiedMapEntry to reach BasicDataSource.getConnection(). Opening that connection runs attacker-controlled init SQL against an in-memory HSQLDB, whose SCRIPT statement writes a polyglot SQL\u002FJSP file into the TeamCity web root, which the server then compiles and executes on the next request.","critical","The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network. Because TeamCity is a build server, code execution also exposes stored CI\u002FCD credentials, signing keys and source code, which can be abused to tamper with build artifacts and reach downstream production systems. The vulnerability is rated critical, requires no authentication, has public exploit code available and is confirmed to be exploited in the wild.","JetBrains TeamCity On-Premises versions before 2026.1.3 and 2025.11.7 are vulnerable to unauthenticated remote code execution via the agent polling protocol. The agent endpoints are exposed without authentication and deserialize untrusted XML with XStream using an incorrectly configured allowlist, which leaves the library's permissive default type permissions in place. An attacker who can reach the TeamCity server over the network can register an agent session and submit a crafted object graph that writes an executable file into the server's web root and runs arbitrary code, without any credentials or user interaction. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog and has been observed being exploited in the wild.","Update JetBrains TeamCity On-Premises to version 2026.1.3 or 2025.11.7 or later, or apply the vendor-provided security patch plugin.","We recommend upgrading JetBrains TeamCity On-Premises to version 2026.1.3 or 2025.11.7 or later. If an immediate upgrade is not possible, JetBrains provides a security patch plugin for TeamCity 2017.1 and newer that addresses this issue, and access to the server and its agent endpoints should be restricted at the network boundary in the meantime. Because this vulnerability is known to be exploited in the wild, we also recommend reviewing the server for unexpected files in the web root, unknown agent registrations, and rotating any credentials stored in TeamCity.",[91,92,93,94],"https:\u002F\u002Fblog.jetbrains.com\u002Fteamcity\u002F2026\u002F07\u002Fcve-2026-63077\u002F","https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002Fetr-cve-2026-63077-critical-unauthenticated-remote-code-execution-in-jetbrains-teamcity\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-63077","https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077",9.8,0.86518,0.99726,[99],"CVE-2026-63077","2026-07-27T00:00:00Z","Continuous Integration Server","JetBrains","TeamCity",[105],"RCE","NETSCAN-SNIPER-CVE-2026-63077","JetBrains TeamCity - Remote Code Execution","2026-09-15T00:00:00Z"]