6 min read
By: RedLegg's Cyber Threat Intelligence Team
About:
CVE-2026-18577 is a high-severity authentication bypass vulnerability affecting N-able N-central, a remote monitoring and management platform used by MSPs and IT teams.
The vulnerability exists because a previous patch for CVE-2026-18556 addressed one exploitation path but left an alternate path to the same underlying weakness accessible. Successful exploitation can allow an attacker to bypass authentication and take over administrative accounts, potentially providing control over the endpoints managed by the affected N-central server.
N-able has confirmed active exploitation of CVE-2026-18577 in the wild. Self-hosted customers should immediately upgrade to build 2026.3.1.7, as upgrading only to 2026.3.1 is not sufficient.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
VULNERABILITIES
Unauthenticated Remote Code Execution via Agent Polling Protocol Deserialization in JetBrains TeamCity On-Premises
Identifier: CVE-2026-63077
PoC or Exploitation:
Confirmed actively exploited in the wild. The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
CVSS Score: 9.8 (Critical, CVSS v3.1)
Update / Patch:
JetBrains has released fixed versions addressing this vulnerability.
Affected versions include:
All versions of TeamCity On-Premises
Fixed versions include:
2025.11.7
2026.1.3
A security patch plugin is also available for TeamCity 2017.1 and later for environments that cannot upgrade immediately.
TeamCity Cloud is not affected. No customer action required.
JetBrains advisory and patch guidance:
Description:
CVE-2026-63077 is an unauthenticated remote code execution vulnerability in JetBrains TeamCity On-Premises.
An attacker with HTTP(S) access to a vulnerable TeamCity server can exploit the flaw without credentials or user interaction to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.
Mitigation Recommendation:
Immediately upgrade affected TeamCity On-Premises servers to version 2025.11.7 or 2026.1.3.
If immediate upgrade is not possible, apply JetBrains' security patch plugin (available for TeamCity 2017.1+) as an interim fix.
Review TeamCity server logs for com.thoughtworks.xstream.converters.ConversionException (possible exploit attempt) and com.thoughtworks.xstream.security.ForbiddenClassException (blocked attempt on patched servers).
Check for unauthorized build agents, particularly those with names beginning with scan, and remove any found.
Restrict network access to TeamCity servers to trusted networks or VPN.
