JetBrains has disclosed a critical security vulnerability in TeamCity On-Premises, identified as CVE-2026-63077. This flaw enables remote attackers to bypass authentication and execute arbitrary operating system commands on affected servers.
The vulnerability impacts all versions of TeamCity On-Premises. Exploitation requires only HTTP or HTTPS access to a vulnerable server, without the need for valid credentials or prior access. The issue resides in the TeamCity agent polling protocol, allowing attackers to circumvent authentication checks and execute commands with the same privileges as the TeamCity server process.
This level of access poses significant risks for organizations utilizing TeamCity for managing software builds, releases, and CI/CD pipelines. A successful exploit could expose sensitive information such as stored credentials, configuration files, build data, and project secrets. Additionally, attackers could alter build settings, modify artifacts, or inject malicious code into downstream software releases.
JetBrains Vulnerability
JetBrains assigned CVE-2026-63077 to this issue following a private report on July 10, 2026, by security researcher Antoni Tremblay through the company’s coordinated disclosure process. The vulnerability has been addressed in TeamCity versions 2025.11.7 and 2026.1.3. Administrators are strongly urged to upgrade to one of these versions immediately or utilize the built-in automatic update feature where available.
For organizations unable to upgrade promptly, JetBrains offers a dedicated security patch plugin compatible with TeamCity versions 2017.1 and later, specifically addressing CVE-2026-63077. However, the company emphasizes that applying the plugin is a temporary solution, as a full version upgrade provides additional important security fixes.
Users of TeamCity version 2024.03 and later can benefit from the platform’s ability to automatically download available security patch plugins and notify administrators when notifications are enabled. Security updates can be accessed from the Administration menu under Updates and Available Security Updates.
It’s important to note that servers running TeamCity versions 2017.1 through 2018.1 will require a restart after installing the plugin. In contrast, versions 2018.2 and later can enable the patch plugin without restarting the server.
JetBrains has confirmed that TeamCity Cloud customers do not need to take any action, as the company has already implemented protections in its cloud environments and found no evidence of exploitation of this flaw in TeamCity Cloud instances.
At the time of the announcement, JetBrains indicated that it was unaware of any active exploitation in the wild. Nevertheless, the risk of unauthenticated remote code execution makes immediate remediation crucial.
Administrators should also restrict TeamCity access to trusted networks, place internet-facing instances behind a VPN or another access control layer, and run the TeamCity service with minimal operating system privileges. Hosting TeamCity servers separately from build agents can further mitigate the impact of a potential compromise.
This incident underscores the critical importance of promptly addressing security vulnerabilities in development and CI/CD tools. Organizations must remain vigilant, regularly update their software, and implement robust access controls to safeguard their development environments against emerging threats.
