Three critical, unauthenticated remote code execution flaws landed in three different tools your engineering
team touches every day — within 48 hours of each other.
CVE-2026-63077 (TeamCity, CVSS 9.8), CVE-2026-59309/59310 (vCenter, CVSS 9.8), and CVE-2026-66066 (Rails Active Storage, CVSS 9.5) were all disclosed July 28-29, 2026. None require authentication.
WHAT ACTUALLY HAPPENED
JetBrains patched an auth bypass in TeamCity's agent polling protocol that let any attacker with HTTP access run arbitrary OS commands on the build server — no credentials needed, all On-Premises versions affected.
Broadcom shipped VMSA-2026-0006 for vCenter: an authentication bypass in VMware Directory Service paired with a directory traversal RCE in the Syslog Server. Both exploit over the network with no workaround — patching is the only fix.
Rails disclosed "KindaRails2Shell": default image-variant processing via libvips lets an unauthenticated attacker read arbitrary files, including env variables holding secret_key_base and service credentials — a direct path to RCE.
WHY THIS CHANGES THE MATH
These aren't edge-case apps. TeamCity runs your build pipeline, vCenter your virtualization layer, Rails your production web apps. One week gave attackers unauthenticated code execution across build, infrastructure, and application layers at once — the exact three layers a real intrusion chain wants in sequence.
If your CI/CD server, your hypervisor management plane, and your app framework all sit on the same patch cadence, this week just tested whether that cadence holds under pressure.
WHAT TO DO NOW
PATCH TEAMCITY FIRST — update to 2025.11.7 or 2026.1.3 immediately; it is unauthenticated and CI/CD servers hold credentials to everything downstream.
LOCK DOWN VCENTER NETWORK ACCESS — apply VMSA-2026-0006 now; there is no workaround, and vCenter exposure means full virtualization layer compromise.
ROTATE SECRETS AFTER PATCHING RAILS — update to 7.2.3.2, 8.0.5.1, or 8.1.3.1 and rotate secret_key_base plus any reachable credentials, since the flaw may have already exposed them.
STOP TREATING INFRASTRUCTURE TOOLS AS TRUSTED BY DEFAULT — build servers, hypervisor managers, and app frameworks are now first-choice initial-access targets, not just post-compromise pivots.
Three tools, three layers, one week. Attackers don't need to chain vulnerabilities when vendors hand them three separate front doors.
Which of these three sits unpatched in your environment right now?