Critical TeamCity Flaw Allows Unauthenticated OS Command Execution
JetBrains TeamCity On-Premises is vulnerable to CVE-2026-63077, a critical flaw allowing unauthenticated attackers to execute arbitrary OS commands.
JetBrains has issued an urgent warning to users of its TeamCity On-Premises continuous integration and continuous delivery (CI/CD) platform, urging them to update immediately due to a critical vulnerability that could allow unauthenticated attackers to execute arbitrary operating system commands.
The flaw, identified as CVE-2026-63077 and carrying a severe CVSS score of 9.8, affects all on-premise versions of TeamCity. JetBrains has addressed the issue by releasing patched versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already been secured. The discovery and responsible disclosure of this vulnerability are credited to Antoni Tremblay, who reported it on July 10, 2026.
According to JetBrains, a successful exploitation of this vulnerability would enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication mechanisms entirely. This bypass would then permit the execution of arbitrary OS commands, leveraging the privileges of the TeamCity server process itself. Such a compromise could lead to the exposure of sensitive TeamCity data, configurations, and stored credentials, or allow for the modification of the server's state.
The attack vector involves exploiting the agent polling protocol, which allows attackers to circumvent authentication checks and directly achieve command execution on the server. The potential impact is significant, as the compromised server could be used as a pivot point for further network intrusion or data exfiltration.
In addition to the full version updates, JetBrains has also provided a security patch plugin for versions 2017.1 and later. This plugin specifically targets CVE-2026-63077, offering a mitigation path for customers unable to immediately upgrade their entire TeamCity installation. However, JetBrains strongly advises upgrading to the latest version to benefit from a comprehensive suite of security updates.
While there is currently no evidence to suggest that CVE-2026-63077 has been exploited in the wild, the severity of the vulnerability and its unauthenticated nature make it a prime target for threat actors. Organizations relying on TeamCity for their CI/CD pipelines should prioritize patching or applying the security plugin without delay.
As a general best practice, JetBrains recommends that customers consider implementing additional security layers for internet-facing TeamCity servers. This could include requiring VPN connections or employing other access control mechanisms to prevent unauthorized access. Even exposing the TeamCity login screen or its REST API can present potential entry points for attackers seeking to exploit newly disclosed vulnerabilities.
This critical vulnerability underscores the ongoing importance of securing CI/CD infrastructure, which often holds privileged access to development pipelines and sensitive code repositories. Prompt patching and robust security hygiene are essential to protect these critical systems from compromise.
JetBrains has released a security patch plugin for TeamCity On-Premises versions 2017.1 and later, offering an alternative to a full upgrade for administrators unable to immediately update their instances. While TeamCity Cloud environments were checked and found to have no signs of exploitation, JetBrains stated they are not aware of any active exploitation of CVE-2026-63077 at the time of their advisory.