Initial Access Community

API / Schema

Integrate with VulnCheck Initial Access Intelligence Community Edition using the VulnCheck API and an easy to follow JSON schema.

VulnCheck Initial Access Intelligence Community Edition is available to VulnCheck Community accounts through the initial-access-community index. You can query it one vulnerability at a time, or download the whole index as a backup.

Query the index

curl --request GET \
    --url 'https://api.vulncheck.com/v3/index/initial-access-community?cve=CVE-2026-63077' \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer insert_token_here'

vulncheck index list initial-access-community --cve CVE-2026-63077

Download the backup

curl --request GET \
    --url https://api.vulncheck.com/v3/backup/initial-access-community \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer insert_token_here'

package main

import (
 "context"
 "encoding/json"
 "fmt"
 "log"
 "os"

 vulncheck "github.com/vulncheck-oss/sdk-go-v2/v2"
)

func main() {
 configuration := vulncheck.NewConfiguration()
 configuration.Scheme = "https"
 configuration.Host = "api.vulncheck.com"

 client := vulncheck.NewAPIClient(configuration)

 token := os.Getenv("VULNCHECK_API_TOKEN")
 auth := context.WithValue(
  context.Background(),
  vulncheck.ContextAPIKeys,
  map[string]vulncheck.APIKey{
   "Bearer": {Key: token},
  },
 )
 resp, httpRes, err := client.EndpointsAPI.BackupIndexGet(auth, "initial-access-community").Execute()

 if err != nil || httpRes.StatusCode != 200 {
  log.Fatal(err)
 }

 prettyJSON, err := json.MarshalIndent(resp.Data, "", "  ")
 if err != nil {
  log.Fatalf("Failed to generate JSON: %v", err)
  return
 }

 fmt.Println(string(prettyJSON))
}

import vulncheck_sdk

configuration = vulncheck_sdk.Configuration(host="https://api.vulncheck.com/v3")
configuration.api_key["Bearer"] = "insert_token_here"

with vulncheck_sdk.ApiClient(configuration) as api_client:
    endpoints_client = vulncheck_sdk.EndpointsApi(api_client)

    api_response = endpoints_client.backup_index_get("initial-access-community")

    print(api_response.data[0].url)

vulncheck backup download initial-access-community

JSON Schema

Each record covers one vulnerability, identified by its CVE, and holds one or more artifacts. Most artifact fields are booleans that say whether an artifact type is available in the repository, or lists of query URLs. The artifactsURL field links to the vulnerability's directory in the repository, where the artifacts themselves live.

Example Initial Access Community entry

Below is an example record from the initial-access-community index.

"data": [
  {
    "id": "625a3455-0711-4aee-baa8-09fe3d1387dc",
    "cve": "CVE-2026-63077",
    "artifacts": [
      {
        "vendor": "JetBrains",
        "targetEncryptedComms": "either",
        "mitreAttackTechniques": [
          "T1190",
          "T1059.004"
        ],
        "product": [
          "TeamCity"
        ],
        "dateAdded": "2026-09-23T00:00:00Z",
        "artifactName": "JetBrains TeamCity Agent Polling XStream Deserialization Unauthenticated RCE",
        "exploit": true,
        "versionScanner": true,
        "pcap": true,
        "sigmaRule": true,
        "suricataRule": true,
        "snortRule": true,
        "yara": true,
        "nmapScript": false,
        "zeroday": false,
        "targetService": "HTTP",
        "targetDocker": true,
        "googleQueries": [],
        "googleRawQueries": null,
        "baiduQueries": [],
        "baiduRawQueries": null,
        "shodanQueries": [
          "https://www.shodan.io/search?query=TeamCity-Node-Id+%2B%22TCSESSIONID%22"
        ],
        "censysQueries": [
          "https://platform.censys.io/search?q=%28web.endpoints.http.headers.key%3A%22TeamCity-Node-Id%22+and+%28web.endpoints.http.headers%3A+%28key%3A+%22Set-Cookie%22+and+value%3A+%22TCSESSIONID%22%29%29%29+or+%28host.services.endpoints.http.headers.key%3A%22TeamCity-Node-Id%22+and+%28host.services.endpoints.http.headers%3A+%28key%3A+%22Set-Cookie%22+and+value%3A+%22TCSESSIONID%22%29%29%29"
        ],
        "driftnetQueries": [],
        "driftnetRawQueries": [],
        "greynoiseQueries": [],
        "fofaQueries": [
          "https://en.fofa.info/result?qbase64=aGVhZGVyPSJUZWFtQ2l0eS1Ob2RlLUlkIiAmJiBoZWFkZXI9IlRDU0VTU0lPTklEIg%3D%3D"
        ],
        "fofaRawQueries": null,
        "zoomEyeQueries": [
          "https://www.zoomeye.ai/searchResult?q=aHR0cC5oZWFkZXI9IlRlYW1DaXR5LU5vZGUtSWQiICYmIGh0dHAuaGVhZGVyPSJUQ1NFU1NJT05JRCI%3D"
        ],
        "zoomEyeRawQueries": null,
        "shodanRawQueries": null,
        "censysRawQueries": null,
        "cloneSSHURL": "git@github.com:vulncheck-oss/initial-access-community.git",
        "artifactsURL": [
          "https://github.com/vulncheck-oss/initial-access-community/tree/main/feed/cve-2026-63077"
        ],
        "vcTargetIntelQuery": [],
        "goexploit": {
          "exploitType": "CodeExecution",
          "protocol": "HTTP",
          "defaultPort": 8111,
          "assetDetection": true,
          "versionScanner": true,
          "exploitation": true,
          "supportedC2": [
            "SSLShellServer",
            "SimpleShellServer",
            "HTTPServeShell",
            "HTTPServeFile"
          ],
          "cpe": [
            "cpe:2.3:a:jetbrains:teamcity"
          ],
          "customFlags": [
            {
              "name": "webroot-relative",
              "type": "string",
              "default": "../webapps/ROOT",
              "usage": "TeamCity webroot relative to the HSQLDB process working directory (default suits the standard Linux/Docker and Windows layouts)"
            },
            {
              "name": "command",
              "type": "string",
              "default": "",
              "usage": "Command to use for the exploit, an empty string will use the exploit default."
            }
          ]
        }
      }
    ]
  }
]

Introduction

Exploit Intelligence 101