A critical vulnerability has been discovered in JetBrains’ TeamCity continuous integration and delivery (CI/CD) server, which could allow attackers to execute malicious code on affected systems with elevated privileges. The security issue, tracked as CVE-2026-63077, affects all versions of TeamCity On-Premises, making it a pressing concern for administrators responsible for securing these environments.
The vulnerability allows an attacker with HTTPS access to a TeamCity server to bypass authentication and execute arbitrary operating system commands using the agent polling protocol. This means that if an attacker can gain access to a TeamCity server via HTTPS, they could potentially exploit this flaw to expose sensitive data, compromise build artifacts, or even disrupt CI/CD pipelines.
JetBrains warns that the vulnerability has not yet been actively exploited, but given the severity of the issue and the potential consequences, administrators are urged to take immediate action. The vendor has already released patches for TeamCity versions 2025.11.7 and 2026.1.3, which should be upgraded to as soon as possible.
For customers unable to upgrade to the latest releases, a security patch is available as a plugin for TeamCity 2017.1+. However, it’s essential to note that this version will require a server restart for the updates to take effect after installing the patch. Additionally, TeamCity versions 2024.03 and newer automatically download available security patch plugins and notify administrators so they can install them.
JetBrains emphasizes the importance of implementing best practices to prevent attacks on TeamCity servers. This includes requiring VPN access or other protective layers on internet-facing servers, as even exposing the login page or REST API can give attackers an entry point to exploit newly disclosed vulnerabilities.
The discovery of this vulnerability serves as a reminder that security teams should continually test and monitor their systems for potential weaknesses. With the average organization experiencing 54% of successful attacks going undetected, it’s crucial to stay proactive in identifying and addressing vulnerabilities before they’re exploited by attackers.
In light of this advisory, we recommend that administrators review their TeamCity configurations and take immediate action to mitigate the risks associated with CVE-2026-63077. This includes upgrading to the latest versions of TeamCity, installing security patches, and implementing best practices for securing CI/CD environments. By staying vigilant and proactive in addressing vulnerabilities, organizations can reduce their exposure to cyber threats and protect sensitive data from potential exploitation.
Source: Bleeping Computer — 2026-07-30