Loading story…
Dassault Systèmes disclosed CVE-2026-7858, a critical deserialization of untrusted data flaw affecting No Magic Teamwork Cloud and Magic Collaboration Studio that can enable unauthenticated remote code execution. The vulnerability carries a CVSS score of 9.8 and impacts Teamwork Cloud from No Magic Release 2022x through 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through 2026x, including Teamwork Cloud Standard, Business, Business Pro, and Enterprise editions.
Reporting on the disclosure said successful exploitation could give attackers full remote takeover of exposed corporate modeling environments over the network without authentication. Organizations were urged to apply vendor updates immediately and reduce exposure by removing vulnerable servers from the public internet and enforcing network segmentation until remediation is complete.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
On 2026-06-01, Dassault Systèmes disclosed CVE-2026-7858, a critical deserialization of untrusted data vulnerability affecting Teamwork Cloud and Magic Collaboration Studio releases from 2022x through 2026x. The advisory said successful exploitation could allow unauthenticated remote code execution and identified affected Teamwork Cloud editions including Standard, Business, Business Pro, and Enterprise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
JetBrains disclosed **CVE-2026-63077**, a critical remote code execution flaw in TeamCity On-Premises that lets unauthenticated attackers with HTTP(S) access abuse the agent polling protocol to bypass authentication and run arbitrary operating system commands. The vulnerability affects TeamCity versions before **2026.1.3** and **2025.11.7**, carries a CVSS 3.1 rating of **9.8** (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`), and is mapped to **CWE-502**. JetBrains released fixes in **2025.11.7** and **2026.1.3**, and also published a security patch plugin for TeamCity versions **2017.1 and later** for organizations that cannot upgrade immediately. TeamCity Cloud instances were already updated, while JetBrains said it has **no evidence of active exploitation**; CISA’s SSVC assessment likewise indicates no known exploitation but notes the bug is **automatable** and could have **total technical impact**. Successful attacks could expose TeamCity data, configurations, and stored credentials, or allow modification of server state depending on the privileges of the TeamCity process.
Aug 25, 2026
Attackers exploited **CVE-2026-63077**, a critical (CVSS 9.8) authentication-bypass and arbitrary-command-execution flaw affecting all JetBrains TeamCity On-Premises versions, to compromise an unpatched TeamCity server supporting JetBrains’ Cadence cloud development service. Activity at `api.cadence.jetbrains.com` ran from August 8 to August 24 and may have exposed a 2024 server backup, user data, source code, credentials, configurations, build artifacts, and logs. JetBrains confirmed compromise of several AWS IAM users and access to files in its AWS S3 buckets, while it continued investigating whether customer storage buckets were accessed. Australian authorities and CISA had already warned of active exploitation and urged organizations to identify exposed TeamCity instances, apply JetBrains updates or its security patch plugin, and remove TeamCity interfaces from direct internet exposure where possible. Public exploit support has also advanced through Metasploit module `exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077`, including improved payload selection for Java/JSP, Windows, and Linux targets. Cadence users should rotate every credential and secret handled by the service, investigate connected environments for unauthorized activity and lateral movement, and treat executions and outputs generated during the exposure period as untrusted.
Aug 28, 2026
BeyondTrust disclosed and fixed **CVE-2026-1731**, a critical unauthenticated remote code execution flaw affecting **Remote Support 25.3.1 and earlier** and **Privileged Remote Access 24.3.4 and earlier**. The vulnerability allows a remote attacker to send crafted client requests and execute system commands on the target appliance as the **site user**, creating a path to full system compromise, data theft, and service disruption. CSIRT.SK reported the issue carries a **CVSS score of 9.9**. BeyondTrust said cloud instances were updated automatically, while organizations running on-premises deployments were told to upgrade to **Remote Support 25.3.2** and **Privileged Remote Access 25.1.1**, or apply the vendor patches **`BT26-02-RS`** and **`BT26-02-PRA`**. The advisory identifies the flaw as a high-priority risk for enterprises using BeyondTrust remote access and support platforms because exploitation requires no authentication and can result in command execution on exposed systems.
Jul 24, 2026