TeamCity On-Premises Critical Flaw (CVE-2026-63077) Lets Attackers Run Code

A newly disclosed critical vulnerability in JetBrains TeamCity On-Premises could allow unauthenticated attackers to seize control of CI/CD pipelines with a single crafted request.

Tracked as CVE-2026-63077, the flaw affects every version of TeamCity On-Premises and carries the kind of severity that keeps DevOps and security teams up at night: authentication bypass paired with arbitrary OS command execution.

JetBrains disclosed the issue on July 27, 2026, crediting security researcher Antoni Tremblay for privately reporting it on July 10 under the company’s coordinated disclosure policy. Patches are already available in versions 2025.11.7 and 2026.1.3.

TeamCity On-Premises Critical Flaw

The core issue lies in TeamCity’s agent polling protocol, which handles communication between the TeamCity server and its build agents.

An unauthenticated attacker with basic HTTP(S) access to a TeamCity server can exploit this channel to bypass authentication entirely and execute arbitrary operating system commands, all with the privileges of the TeamCity server process itself.

Because TeamCity servers often sit at the heart of software build and deployment workflows, successful exploitation could expose sensitive data, configurations, and stored credentials. Attackers could also modify server state or tamper with build artifacts, effectively poisoning downstream CI/CD pipelines. That makes this less a single-server compromise and more a potential supply-chain risk.

All TeamCity On-Premises versions are impacted, regardless of deployment size. TeamCity Cloud customers can breathe easier; JetBrains confirmed the necessary protections are already in place on the cloud side, and no evidence of exploitation has been found there.

As of publication, JetBrains states there’s no evidence of active exploitation in the wild for On-Premises deployments either. That window won’t stay open long, given how quickly threat actors typically reverse-engineer patches for widely used CI/CD tools.

Mitigation

JetBrains has laid out two mitigation routes depending on how quickly organizations can act:

Upgrade directly to TeamCity 2025.11.7 or 2026.1.3 via manual download or the built-in automatic update feature; this fully resolves CVE-2026-63077 plus other accumulated security fixes.
Apply the security patch plugin if an immediate upgrade isn’t feasible. This plugin supports TeamCity 2017.1 and later, though versions 2017.1–2018.1 require a server restart to take effect; 2018.2 and newer can apply it without downtime.

Organizations running TeamCity 2024.03 or later benefit from automatic detection of available security patches, visible under Administration | Updates. JetBrains emphasizes that the plugin only addresses this specific CVE; a full upgrade remains the recommended long-term fix.

Beyond patching, JetBrains is urging teams to rethink exposure for internet-facing TeamCity instances. Recommendations include placing servers behind a VPN or additional access-control layer, since even exposing the login screen or REST API gives attackers a foothold to probe for future vulnerabilities.

Additional best practices include running the TeamCity server process with minimum required OS privileges and hosting the server on dedicated infrastructure separate from build agents a segmentation strategy that limits blast radius if either component is compromised.

Given TeamCity’s widespread use across enterprise DevOps environments, security teams should treat this as a same-day patching priority rather than a routine maintenance item.