September "In the VM Spotlight": TeamCity, TrueConf, SharePoint, Windows, and Zimbra

⚡ The gist in 5 seconds - The gist: in the September "In the VM Spotlight" digest, Positive Technologies experts highlighted six new trending vulnerabilities — in TeamCity, TrueConf, SharePoint, Windows, and Zimbra. - Where to find it: the full overview is published on the company's blog on Habr. - Limitation: only vulnerabilities already used in real attacks or with a high likelihood of exploitation in the near future make it into the digest. ### 🔍 What was found The key finding of the month is a critical vulnerability in JetBrains TeamCity (PT-2026-65062, CVE-2026-63077, CVSS 9.8). It is caused by insecure deserialization of XML data (CWE-502) and allows an unauthenticated remote attacker to execute arbitrary OS commands with TeamCity Server process privileges via the agent polling protocol. The issue affects all on-premises servers prior to versions 2025.11.7 and 2026.1.3. CISA added CVE-2026-63077 to the KEV catalog on August 5; JetBrains confirmed attack attempts and an incident in its own JetBrains Cadence service. In late August, ACSC recorded multiple attacks on TeamCity in Australia. A PoC is already publicly available, and as of August 28 there is a Metasploit module. According to JetBrains, more than 30,000 organizations use TeamCity, while Censys found about 4,500 exposed web interfaces. The second group consists of two critical vulnerabilities in the Russian TrueConf Server: CVE-2026-72529 (CVSS 9.8) and CVE-2026-72530 (CVSS 9.0). The first is caused by missing authentication for a critical function (CWE-306) and allows an unauthenticated attacker to remotely execute code on the server, albeit in an isolated sandbox. The list also includes an authentication bypass in Microsoft SharePoint Server (CVE-2026-55040), a privilege escalation in the Windows Ancillary Function Driver (CVE-2026-68820), and remote code execution in Zimbra Collaboration Suite (CVE-2026-73570). ### 💡 Why it matters These vulnerabilities are not theoretical: some are already actively exploited in real attacks, and for TeamCity there is a public exploit and Metasploit automation. For organizations using TeamCity, TrueConf, SharePoint, Windows, or Zimbra, this is a signal to immediately check versions and apply patches, especially for internet-facing servers. The digest helps security teams focus on the most dangerous issues of the month without drowning in the stream of bulletins. ### 🧩 Context The digest author is Alexander Leonov, lead expert at the Positive Technologies security center (PT ESC). Together with a team of analysts, he regularly analyzes the flow of information from vendor bulletins, social media, blogs, Telegram channels, code repositories, vulnerability databases, and exploits. From this variety, experts identify trending vulnerabilities that are already being used in attacks or are highly likely to be exploited. Since the previous digest, six new entries have been added to the overall list. The article was published on Habr on September 28.

🔗 Read on habr.com