A Critical Code Execution Vulnerability in TeamCity Has Been Patched, but Users Must Act Quickly to Protect Their Environments
JetBrains has released patches for a critical-severity vulnerability in its TeamCity On-Premises software that can be exploited without authentication. The security flaw, tracked as CVE-2026-63077 with a CVSS score of 9.8, allows an unauthenticated attacker to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.
This vulnerability is particularly concerning because it can be exploited via HTTP/S, making it relatively easy for attackers to access TeamCity data, configurations, and credentials. Depending on the available privileges, an attacker could also tamper with the server state, compromise build artifacts, and disrupt downstream CI/CD pipelines.
The good news is that JetBrains has already rolled out mitigations for TeamCity Cloud instances and has no evidence that the bug has been exploited in the wild. However, all TeamCity On-Premises versions are affected by this vulnerability, making it essential for users to take immediate action to protect their environments.
To patch the vulnerability, users can download and install either the latest version of TeamCity (2025.11.7 or 2026.1.3) or a security patch plugin that resolves only this CVE. The plugin is available for versions 2017.1 and later, allowing users who cannot upgrade to still protect their environments.
In addition to patching the vulnerability, JetBrains recommends several best practices to prevent unauthorized access:
Limit access to internet-facing TeamCity servers
Run all servers with the minimum required operating system privileges
Use VPN connections or implement additional protections to prevent unauthorized access
TeamCity servers should be run on dedicated hosts separate from build agents
It’s essential for users to take these recommendations seriously and act quickly to protect their environments. The risk of exploitation is high, and a delay in patching could lead to significant consequences.
In summary, the critical code execution vulnerability in TeamCity has been patched, but users must take immediate action to protect their environments. By downloading and installing the latest patches or security plugins and implementing best practices, users can prevent unauthorized access and minimize the risk of exploitation.
Source: SecurityWeek — 2026-07-31