A critical vulnerability in JetBrains TeamCity (CVE-2026-63077, CVSS 9.8) allows unauthenticated attackers to execute arbitrary operating system commands on affected on-premises servers. JetBrains released emergency patches on July 28, 2026, covering all supported versions.
Vulnerability Details
CVE-2026-63077 is an authentication bypass in TeamCity's agent polling protocol that leads to remote code execution. The flaw affects all TeamCity On-Premises versions prior to 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already been patched.
| Property | Value |
|---|---|
| CVE ID | CVE-2026-63077 |
| CVSS v3.1 Score | 9.8 (Critical) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Affected Versions | All On-Premises < 2025.11.7, < 2026.1.3 |
| Fixed Versions | 2025.11.7, 2026.1.3 |
| Discovered By | Antoni Tremblay |
| Reported | July 10, 2026 |
| Patched | July 28, 2026 |
Impact Assessment
If exploited, this vulnerability allows an unauthenticated attacker with HTTP(S) access to the TeamCity server to:
- Bypass all authentication checks completely
- Execute arbitrary OS commands with the privileges of the TeamCity server process
- Access all build configurations, artifacts, and stored credentials
- Modify server state, create malicious build steps, or poison artifacts
- Pivot to connected build agents and internal networks
The severity stems from the zero-privilege requirement — no valid credentials, no user interaction, and no special network position are needed. Any network access to the TeamCity web interface is sufficient.
Affected Systems
Vulnerable:
- TeamCity On-Premises all versions before 2025.11.7
- TeamCity On-Premises all versions before 2026.1.3 (2026.x line)
Not Affected:
- TeamCity Cloud (automatically updated)
- Versions 2025.11.7 and later
- Versions 2026.1.3 and later
Mitigation & Patching
Immediate Action Required
-
Upgrade to patched versions:
- 2025.11.7 for 2025.x line
- 2026.1.3 for 2026.x line
-
If immediate upgrade is not possible, apply the security patch plugin:
- Download:
https://download.jetbrains.com/teamcity/plugins/internal/fix_CVE_2026_63077.zip - Install via Administration → Plugins → Upload plugin zip
- Restart TeamCity server
- Download:
Note from JetBrains: The security patch plugin addresses only CVE-2026-63077. Upgrading to the latest version is always recommended to benefit from all security fixes.
Network-Level Mitigations
While patching, implement these defense-in-depth measures:
- Require VPN connections for TeamCity access
- Implement an extra authentication layer (e.g., mutual TLS, OAuth proxy)
- Block internet exposure of TeamCity web interface and REST API
- Monitor for unusual agent polling patterns
Detection
Network Indicators
Watch for these suspicious patterns in logs:
Host-Based Detection
YARA Rule
Suricata Rule
Frequently Asked Questions
Q: Is there evidence of active exploitation? A: As of July 28, 2026, JetBrains reports no evidence of exploitation in the wild. However, given the trivial exploitation path, assume capability exists and patch immediately.
Q: Does the patch plugin require a restart? A: Yes, the TeamCity server must be restarted after installing the security patch plugin.
Q: Are build agents affected? A: The vulnerability is in the TeamCity server's agent polling endpoint. Build agents themselves are not directly vulnerable, but a compromised server can push malicious commands to agents.
Q: What if I'm on an older version (pre-2017.1)? A: The patch plugin supports versions 2017.1+. For versions older than 2017.1, upgrade is the only option — no patch plugin is available.
Q: Does this affect TeamCity Cloud? A: No. JetBrains confirmed TeamCity Cloud instances were automatically updated before public disclosure.
Key Takeaways
- Patch immediately — CVE-2026-63077 is a 9.8 CVSS unauthenticated RCE in a widely deployed CI/CD platform
- Upgrade to 2025.11.7 or 2026.1.3 — or apply the security patch plugin if upgrade requires scheduling
- Never expose TeamCity directly to the internet — VPN, mutual TLS, or auth proxy are mandatory
- Monitor agent polling anomalies — unusual IPs or patterns in agent registration are early warning signs
- Rotate all credentials stored in TeamCity after patching — the server process had access to all secrets
Sources:
- JetBrains TeamCity Security Bulletin
- JetBrains Security Patch Plugin Download
- The Hacker News Coverage
- NVD CVE-2026-63077 Entry
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.