JetBrains has revealed a critical security vulnerability in TeamCity On-Premises that enables unauthenticated remote code execution (RCE) on affected servers. This poses a significant risk to CI/CD environments exposed over HTTP(S).
The vulnerability, tracked as CVE-2026-63077, affects all supported versions of TeamCity On-Premises and allows attackers with network access to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.
This dramatically increases the potential impact of a security breach, as TeamCity often serves as a central automation hub in software delivery pipelines.
Critical JetBrains TeamCity Flaw
According to JetBrains’ advisory, the vulnerability lies in how TeamCity handles the agent polling protocol. An unauthenticated attacker can exploit this flaw to circumvent standard authentication controls.
Once the vulnerability is exploited, the attacker can execute arbitrary commands on the underlying host, potentially exposing build configurations, stored credentials, and sensitive project data managed by the CI/CD system.
The fallout from such an attack could include unauthorized modification of server states, tampering with build pipelines, and the introduction of malicious artifacts into downstream environments, which can have cascading effects across an organization’s software supply chain.
JetBrains reports that the issue was privately disclosed on July 10, 2026, by security researcher Antoni Tremblay as part of a coordinated vulnerability disclosure process.
At the time of publication, JetBrains stated that there is no evidence of active exploitation against TeamCity Cloud environments. They confirmed that mitigations have already been implemented for that hosted service.
However, on-premises deployments remain vulnerable until they are patched, especially if the TeamCity server is accessible over the internet or from untrusted networks.
The vulnerability has been addressed in TeamCity versions 2025.11.7 and 2026.1.3. JetBrains strongly urges customers to upgrade to one of these versions as the primary form of mitigation.
For organizations unable to update immediately, a dedicated security patch plugin has been released for TeamCity versions 2017.1 and later, specifically addressing CVE-2026-63077.
Additionally, for newer releases such as TeamCity 2024.03 and beyond, the platform can automatically retrieve available security patch plugins and notify administrators, who can then apply them through the built-in update mechanism.
JetBrains emphasizes that while the plugin addresses this specific flaw, upgrading remains critical for receiving broader security enhancements.
As a precautionary measure, JetBrains recommends restricting network access to TeamCity servers to trusted networks or VPN users, and avoiding direct exposure of the login page or REST API on the public internet.
Organizations are also encouraged to run the TeamCity server with minimal operating system permissions and to host it on dedicated infrastructure separate from build agents.
This limits an attacker’s ability to pivot laterally in the event of a compromise. This incident highlights the strategic value of CI/CD platforms to attackers. It underscores the importance of continuous patching, strict access control, and architectural isolation surrounding build and deployment infrastructure.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
