TeamCity Flaw

Overview

JetBrains has issued urgent updates for TeamCity On‑Premises following the discovery of a critical vulnerability, CVE‑2026‑63077, with a CVSS score of 9.8. The flaw allows unauthenticated attackers to execute arbitrary operating system commands simply by having HTTP(S) access to a TeamCity server — bypassing authentication entirely.

Vulnerability Details

• CVE‑2026‑63077: Critical unauthenticated remote code execution.
• Attack vector: Exploitation of the agent polling protocol to sidestep authentication checks.
• Impact:
  • Exposure of TeamCity data, configurations, and stored credentials.
  • Modification of server state.
  • Arbitrary OS command execution with the privileges of the TeamCity server process.

Affected Versions

• All TeamCity On‑Premises versions are vulnerable.
• Fixed in: 2025.11.7 and 2026.1.3.
• TeamCity Cloud instances have already been patched.
• JetBrains also released a security patch plugin for versions 2017.1+ to help customers unable to upgrade immediately.

Exploitation Status

• No evidence yet of in‑the‑wild exploitation.
• JetBrains credited Antoni Tremblay for discovering and reporting the flaw on July 10, 2026.

Defensive Guidance

JetBrains recommends:

• Upgrade immediately to patched versions.
• If upgrading is not possible, apply the security patch plugin for versions 2017.1+.
• Restrict access to TeamCity servers via VPN or additional security layers.
• Avoid exposing the TeamCity login screen or REST API to the internet, as these can serve as entry points for attackers.

Expert in the Cloud Insight

This flaw underscores the high stakes of CI/CD security. TeamCity servers often hold sensitive build pipelines, credentials, and deployment configurations — making them prime targets for attackers. With unauthenticated RCE possible, organizations must treat this vulnerability as critical infrastructure risk. The lesson is clear: patch fast, restrict exposure, and monitor for anomalies to safeguard enterprise DevOps environments.