A Critical Vulnerability in TeamCity Exposes Organizations to Remote Code Execution Attacks
A devastating security flaw has been discovered in TeamCity On-Premises, a popular continuous integration and delivery (CI/CD) platform used by thousands of organizations worldwide. The vulnerability, tracked as CVE-2026-63077, allows attackers to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.
The bug is particularly concerning because it can be exploited without any form of authentication, making it a highly attractive target for malicious actors. According to JetBrains, the company behind TeamCity, an unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol to gain access to sensitive data, tamper with the server state, and potentially compromise build artifacts and downstream CI/CD pipelines.
The impact of this vulnerability is far-reaching, as it affects all versions of TeamCity On-Premises. However, JetBrains has already rolled out mitigations for TeamCity Cloud instances and has no evidence that the bug has been exploited in the wild. The company recommends that users download and install either the latest version of TeamCity or a security patch plugin to resolve the issue.
The vulnerability works by allowing an attacker to bypass authentication checks through the TeamCity agent polling protocol. This protocol is used for communication between the TeamCity server and client, and it appears that JetBrains has not properly validated incoming requests, making it possible for attackers to execute arbitrary code with elevated privileges.
This vulnerability highlights the importance of proper security protocols and regular software updates in preventing cyber attacks. Organizations using TeamCity On-Premises must act swiftly to patch their systems and prevent potential exploitation. Additionally, JetBrains recommends limiting access to internet-facing TeamCity servers, running all servers with minimal required operating system privileges, and implementing additional protections to prevent unauthorized access.
In light of this vulnerability, it is essential for organizations to prioritize regular security updates and patches, as well as maintain a robust cybersecurity posture that includes proper access controls, monitoring, and incident response planning. By taking these steps, organizations can significantly reduce their exposure to remote code execution attacks and protect sensitive data from unauthorized access.
Source: SecurityWeek — 2026-07-31