JetBrains has disclosed a critical vulnerability in TeamCity On-Premises, tracked as CVE-2026-63077, that allows unauthenticated remote code execution with a CVSS 3.1 score of 9.8. The flaw affects all versions of TeamCity On-Premises and was privately reported on July 10, 2026, with patches released on July 27, 2026.
Vulnerability Details
CVE-2026-63077 is a deserialization of untrusted data vulnerability in the TeamCity agent polling protocol. An unauthenticated attacker with HTTP(S) access to a TeamCity server can bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.
CVSS 3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 Base Score: 9.8 (Critical)
EPSS Score: 1% (47th percentile)
CISA KEV Status: Not currently listed
CWE: CWE-502 (Deserialization of Untrusted Data)
Impact Assessment
Successful exploitation grants the attacker full control over the TeamCity server process. Depending on the operating system privileges assigned to the TeamCity service, this can lead to:
- Credential theft: Access to stored secrets, API tokens, and service account credentials used in build configurations
- Pipeline compromise: Modification of build artifacts, injection of malicious code into deployment pipelines
- Lateral movement: Using TeamCity's integration with cloud providers, Kubernetes clusters, and version control systems to pivot into connected infrastructure
- Supply chain attacks: Tampering with artifacts published to artifact repositories (npm, Maven, Docker registries, NuGet feeds)
At the time of disclosure, JetBrains stated they were not aware of active exploitation. However, given the critical nature and the ease of exploitation (unauthenticated, network-accessible), organizations should assume imminent weaponization.
Affected Systems
| Product | Affected Versions | Fixed Versions |
|---|---|---|
| TeamCity On-Premises | All versions prior to 2025.11.7 | 2025.11.7, 2026.1.3 |
| TeamCity Cloud | Not affected (patched by vendor) | N/A |
TeamCity versions 2017.1 and later can also apply a security patch plugin as a temporary mitigation.
Mitigation & Patching
Primary Fix: Upgrade Immediately
Organizations running TeamCity On-Premises must upgrade to a patched version:
- TeamCity 2025.11.7 (LTS branch)
- TeamCity 2026.1.3 (Current release)
Upgrade via the TeamCity UI automatic update workflow or by downloading and installing the patched version.
Temporary Mitigation: Security Patch Plugin
If immediate upgrade is not possible, install the security patch plugin on TeamCity 2017.1+. For versions 2024.03+, TeamCity automatically downloads and notifies administrators of available security patches under Administration > Updates > Available security updates.
Important: The plugin only addresses CVE-2026-63077. Upgrading to a fixed version is still required to receive other security fixes.
Defense-in-Depth Measures
Regardless of patching status, implement these network controls:
- Restrict TeamCity server access to trusted networks only (VPN, zero-trust network access)
- Do not expose TeamCity directly to the internet
- Run TeamCity server with minimal OS privileges (dedicated service account, not root/SYSTEM)
- Separate TeamCity server from build agents on dedicated hosts
- Monitor TeamCity audit logs for anomalous agent connections or configuration changes
Detection
Indicators of Compromise
While no public IOCs exist yet, Rapid7 customers can detect exposure using the vulnerability check released in the July 28, 2026 content update for Exposure Command, InsightVM, and Nexpose.
Log-Based Detection
Monitor TeamCity server logs for:
- Unusual agent polling requests from unknown IP ranges
- Authentication bypass attempts in the agent protocol handler
- Unexpected process execution from the TeamCity service account
- Modifications to build configurations or project settings by unrecognized users
Network-Based Detection
Security teams should deploy network signatures for the agent polling protocol. The vulnerability is triggered through the agent communication endpoint, typically on port 8111 (HTTP) or 8112 (HTTPS).
Frequently Asked Questions
Does this affect TeamCity Cloud?
No. JetBrains has already patched TeamCity Cloud environments. Cloud customers do not need to take action.
Is there a workaround without upgrading?
The security patch plugin provides a temporary fix for CVE-2026-63077 on versions 2017.1+. However, it does not address other potential vulnerabilities. Full upgrade is strongly recommended.
How can I check my TeamCity version?
Navigate to Administration > Global Settings in the TeamCity UI, or check the footer of any TeamCity page. The version is also visible in the server logs at startup.
What if I cannot upgrade immediately?
Apply the security patch plugin and implement strict network segmentation: restrict TeamCity access to known build agent IPs and administrative workstations only. Deploy WAF rules to inspect agent protocol traffic.
Are build agents affected?
No. The vulnerability is in the TeamCity server's handling of the agent polling protocol. Build agents themselves are not vulnerable, but compromised servers can push malicious commands to agents.
Has this been exploited in the wild?
As of July 29, 2026, JetBrains and Rapid7 report no evidence of active exploitation. However, the vulnerability is trivially exploitable once a proof-of-concept is published.
Key Takeaways
- CVE-2026-63077 is a maximum-severity unauthenticated RCE in a widely deployed CI/CD platform
- All TeamCity On-Premises versions are affected — no version is immune
- Patches are available in 2025.11.7 and 2026.1.3; a security patch plugin covers 2017.1+
- Network segmentation is critical — TeamCity should never be internet-exposed
- Assume rapid weaponization — prioritize patching within hours, not days
Conclusion
CVE-2026-63077 represents a critical risk to software supply chains. TeamCity sits at the heart of build and deployment pipelines for thousands of organizations. A compromised TeamCity server can poison artifacts, steal credentials, and provide a persistent foothold in development infrastructure. Organizations must treat this as a drop-everything-and-patch event.
Sources: JetBrains Security Advisory, Rapid7 Vulnerability Database, NVD Entry
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.