JetBrains has released urgent security updates to address a critical vulnerability in TeamCity On-Premises, identified as CVE-2026-63077. This flaw allows unauthenticated attackers with HTTP(S) access to bypass authentication and execute arbitrary operating system commands on affected servers. All versions of TeamCity On-Premises are impacted, while TeamCity Cloud instances have already been patched.
The vulnerability was privately reported on July 10, 2026, by security researcher Antoni Tremblay through JetBrains’ coordinated disclosure process. JetBrains published an advisory on July 27, 2026, urging administrators to upgrade to versions 2025.11.7 or 2026.1.3 to mitigate the risk. For those unable to upgrade immediately, a dedicated security patch plugin is available for versions 2017.1 and later.
Exploitation of this vulnerability could grant attackers access to sensitive project data, server configurations, stored credentials, and build settings. They might also modify build jobs, tamper with generated artifacts, and potentially compromise downstream CI/CD pipelines. The severity of the impact depends on the privileges assigned to the TeamCity service account; servers running with elevated permissions are at greater risk.
JetBrains recommends that affected installations be upgraded through manual download or the TeamCity automatic update feature. The patched releases fully address CVE-2026-63077. Additionally, the security patch plugin can be installed without restarting the server for versions 2018.2 onward; versions 2017.1 through 2018.1 require a server restart post-installation.
As a defense-in-depth measure, organizations should restrict TeamCity access to trusted networks, place internet-facing instances behind a VPN or additional access-control layer, and run the TeamCity service with minimum required privileges. Hosting TeamCity servers separately from build agents is also advised to reduce potential compromise impact.
Given the critical nature of this vulnerability and the potential for severe consequences, organizations using TeamCity On-Premises should prioritize applying the necessary updates or patches without delay to secure their development environments.
