Organizations using JetBrains TeamCity should immediately review their environments after the disclosure of a critical security vulnerability that could allow attackers to execute operating system commands without logging in. The flaw, tracked as CVE-2026-63077, has received a CVSS score of 9.8, highlighting the severe risk it poses to organizations relying on TeamCity for software development and CI/CD operations.
JetBrains has already released security updates and is strongly encouraging all customers running on-premises TeamCity servers to apply the fixes as soon as possible.
CVE-2026-63077 is a critical remote code execution (RCE) vulnerability affecting all TeamCity On-Premises versions. According to JetBrains, the flaw can allow an unauthenticated attacker with network access to a TeamCity server over HTTP or HTTPS to bypass authentication mechanisms and execute arbitrary operating system commands.
The vulnerability was discovered and responsibly disclosed by security researcher Antoni Tremblay on July 10, 2026.
If successfully exploited, attackers could gain the same privileges as the TeamCity server process, potentially giving them extensive control over the affected system.
The security issue exists within TeamCity’s agent polling protocol. By exploiting weaknesses in the protocol, attackers can bypass authentication checks that normally prevent unauthorized access.
This means a threat actor does not need valid credentials to interact with the vulnerable server. Once access is achieved, they can execute commands directly on the underlying operating system.
Because TeamCity is often integrated into software development pipelines and connected to multiple enterprise systems, exploitation could have serious consequences for organizations of all sizes.
A successful attack against a vulnerable TeamCity server could result in:
- Unauthorized execution of operating system commands
- Exposure of sensitive TeamCity data
- Access to stored credentials and secrets
- Theft of configuration files
- Modification of server settings and build pipelines
- Potential movement into connected enterprise environments
- Disruption of software development and deployment processes
The actual impact depends on the permissions assigned to the TeamCity server process. Servers running with elevated privileges may face a significantly higher level of risk.
For many organizations, TeamCity acts as a central component of their Continuous Integration and Continuous Delivery (CI/CD) infrastructure. As a result, a compromise could provide attackers with opportunities to manipulate source code, build artifacts, deployment workflows, and other critical development resources.
JetBrains confirmed that all TeamCity On-Premises versions are affected by the vulnerability.
The issue has been fixed in the following releases:
- TeamCity 2025.11.7
- TeamCity 2026.1.3
Customers using TeamCity Cloud are not required to take action, as JetBrains has already applied the necessary fixes to cloud-hosted instances.
Organizations running older versions should prioritize updating to one of the patched releases immediately.
Recognizing that some organizations may not be able to upgrade immediately, JetBrains has also released a dedicated security patch plugin.
The plugin is available for TeamCity versions 2017.1 and later, allowing administrators to mitigate the vulnerability while planning a full upgrade.
However, JetBrains emphasized that the plugin addresses only CVE-2026-63077 and does not include the broader security improvements available in the latest product versions.
For this reason, the company continues to recommend upgrading to the most recent TeamCity release whenever possible.
At the time of disclosure, JetBrains stated that there is no evidence of active exploitation in the wild.
While this is encouraging, security experts generally warn organizations against delaying remediation of critical vulnerabilities. Attackers often move quickly after technical details become public, especially when vulnerabilities allow unauthenticated remote code execution.
Historically, critical flaws in CI/CD platforms have attracted significant attention from cybercriminals because these systems frequently store credentials, API keys, source code, and deployment secrets.
In addition to applying updates, organizations should review the exposure of their TeamCity servers and implement additional security controls where possible.
Recommended actions include:
- Upgrade TeamCity to a patched version immediately.
- Apply the official security patch plugin if an upgrade is not currently feasible.
- Restrict public internet access to TeamCity servers.
- Require VPN connectivity for administrative access.
- Implement network segmentation and access controls.
- Monitor TeamCity logs and server activity for suspicious behavior.
- Review stored credentials and rotate sensitive secrets if compromise is suspected.
- Follow the principle of least privilege for TeamCity service accounts.
JetBrains also warned that exposing TeamCity services directly to the internet increases risk. Even publicly accessible login pages and REST APIs can provide attackers with opportunities to target newly disclosed vulnerabilities.
CI/CD platforms have become high-value targets because they sit at the center of modern software development environments. A compromise of TeamCity can potentially provide attackers with access to source code repositories, deployment pipelines, infrastructure credentials, and production environments.
Given the critical severity of CVE-2026-63077 and its ability to enable unauthenticated remote code execution, organizations should treat this vulnerability as a top-priority security issue.
Prompt patching, restricted network exposure, and strong access controls remain the most effective defenses against potential exploitation.
Interesting Article : SharePoint Security Alert, CVE-2026-50522 RCE Exploited in Real-World Cyberattacks