ASD's Australian Cyber Security Centre warns of active exploitation of CVE-2026-63077 in TeamCity On‑Premises servers that may permit unauthenticated attackers with HTTP(S) access to bypass authentication and execute arbitrary operating system commands. The advisory urges organisations to identify and patch vulnerable TeamCity instances, avoid exposing the interface to the internet, apply vendor mitigation guidance, monitor for suspicious activity using vendor-provided IoCs, and contact ACSC if compromise is suspected.