Your VPN and CI/CD Are Now Shared High-Value Targets
The latest enterprise security advisory highlights how simultaneous critical flaws in remote access VPNs and CI/CD platforms let attackers bypass authentication and execute commands on core infrastructure, turning exposed perimeter devices and build systems into high-value entry points for ransomware, espionage, and supply-chain attacks if administrators delay patching and basic mitigations. The uncomfortable reality is that both your Palo Alto GlobalProtect VPN edge and your self-hosted TeamCity instance can now be abused as a single kill chain: one to walk through the front door, the other to quietly rewrite your software. If you own either technology, inaction this week is an operational decision to accept preventable compromise risk to both your network and your pipelines.
On the perimeter, a flaw in GlobalProtect, tracked as CVE-2026-0257, allows attackers to bypass authentication and establish an unauthorized connection on affected PAN-OS portals and gateways. Inside your build environment, CVE-2026-63077 in JetBrains TeamCity lets unauthenticated attackers run operating system commands on exposed on‑premises servers over HTTP or HTTPS. Together, these two issues can undermine your network security and CI/CD integrity in one campaign. Admins need to treat them as connected risks, not isolated bugs, and prioritize a coordinated response across networking and DevOps teams rather than handing attackers a convenient, unguarded path from edge device to build server.
GlobalProtect VPN Exploit: Edge Devices Leave No Patch Grace Period
CVE-2026-0257 in Palo Alto’s GlobalProtect VPN is a textbook example of why perimeter gear must be patched first, not last. The flaw affects the GlobalProtect portal and gateway in PAN‑OS and allows attackers to bypass VPN authentication and open an unauthorized session. Its CVSS score has been upgraded to 7.8, moving it from medium to high severity after evidence of in‑the‑wild exploitation surfaced. That upgrade is not paperwork; it is a warning that your VPN is an active hunting ground.
Security teams have already observed waves of attacks since mid‑May, with managed detection services confirming successful exploitation against multiple customers while noting no clear lateral movement yet. Palo Alto has released a patch for affected appliances, and the vendor’s own advisory acknowledges exploit attempts on unpatched PAN‑OS devices without mitigations applied. One quotable point for any internal briefing is: “The exploitation of this GlobalProtect vulnerability by the Qilin ransomware gang demonstrates that perimeter defences are prime targets”. If your edge still runs unpatched code, assume it is being probed and treat patching as an emergency change, not a backlog task.
TeamCity RCE: From Build Server to Supply-Chain Incident
The TeamCity vulnerability is not "just another RCE"; it is a direct threat to the integrity of your software supply chain. JetBrains has patched a critical TeamCity flaw, CVE-2026-63077, that allows unauthenticated attackers to run operating system commands on exposed, self‑hosted TeamCity On‑Premises servers reachable over HTTP or HTTPS. Attackers can exploit the agent polling protocol without authenticating, bypassing access controls and executing commands with the privileges of the TeamCity server process. TeamCity Cloud customers are spared—this one is squarely an on‑premises admin problem.
Because TeamCity often connects to source repositories, build agents, credentials, artifact stores, signing systems, and deployment infrastructure, a single compromise can cascade across everything you build and ship. Prior incidents show how attackers target developer and CI/CD systems for high‑impact access rather than noisy endpoint infections. JetBrains disclosed CVE‑2026‑63077 on July 27 and released fixes in TeamCity 2025.11.7 and 2026.1.3, which include this CVE and more than 20 other security issues. Delaying the TeamCity vulnerability patch is effectively giving attackers a remote shell over your release process and the secrets it holds.
Immediate Actions: Patching, Versions, and Hardening Steps
The first priority is straightforward: apply the available vendor fixes. For GlobalProtect, Palo Alto has issued a patch for affected PAN‑OS devices, and admins should deploy it ahead of almost any other change window. Given active exploitation tied to Qilin ransomware activity, treating this as a routine medium‑risk update is a mistake. Disable authentication override features on GlobalProtect portals and gateways as advised, especially where authentication override cookies are enabled, to reduce the current GlobalProtect VPN exploit surface.
For TeamCity, upgrade on‑premises servers to 2025.11.7 or 2026.1.3 as soon as possible; both releases provide the CVE‑2026‑63077 fix and additional hardening. Where you cannot complete a full upgrade quickly, install JetBrains’ security patch plugin on TeamCity 2017.1 or later; this plugin addresses only CVE‑2026‑63077, not other vulnerabilities. Until any fix is in place, restrict TeamCity access to trusted networks or require a VPN or other authenticated access layer, and run the server with minimal OS privileges on a host separate from build agents. These steps will not replace patching, but they can shrink the blast radius while you work through maintenance windows.
If You Cannot Patch Today: Mitigation and Risk Review
Some environments cannot patch immediately; that does not mean you accept full exposure. For GlobalProtect, verify whether Cloud Authentication Service is disabled and whether authentication override cookies are enabled, since compromised environments in current waves often shared these traits. Where feasible, turn off authentication override features to cut a known GlobalProtect VPN exploit path until patches are live. At the same time, tighten monitoring at the edge: log VPN sessions, look for unusual sources or service accounts, and prepare to rotate credentials if abuse is suspected.
On the TeamCity side, if you must delay a full version upgrade, treat the security patch plugin as a minimum bar for CVE‑2026‑63077 while you plan the real fix. Enforce network segmentation so only trusted users and systems can reach the server, and require an authenticated access layer rather than leaving it exposed on the open internet. After patching, review for signs of compromise: unexpected processes, configuration changes, new user accounts, suspicious tokens, or altered build artifacts. Where you cannot rule out intrusion, preserve forensic data, rotate high‑value credentials, and validate releases built while the server was exposed. The conclusion for admins is blunt: treat VPNs and CI/CD as one security domain, and close these holes now, or attackers will connect them for you.
