TeamCity CVE-2026-63077: Critical Unauthenticated RCE, Affected Versions and Patch Guide
CVE-2026-63077 is a critical unauthenticated remote-code-execution flaw in JetBrains TeamCity On-Premises. JetBrains rates it CVSS 9.8. An attacker who can reach a vulnerable TeamCity server over HTTP or HTTPS can abuse the agent polling protocol to bypass authentication checks and execute operating-system commands with the privileges of the TeamCity server process.
JetBrains fixed the issue in TeamCity 2025.11.7 and 2026.1.3 and also released a security patch plugin for older supported installations. TeamCity Cloud customers do not need to patch this issue themselves because JetBrains says the required protections were already applied to the managed service.
The most important status detail is also the one most likely to be overstated: JetBrains said it was not aware of active exploitation when it disclosed the vulnerability on July 27, 2026, and the authoritative sources checked for this article do not establish a later confirmed in-the-wild exploitation event. Treat claims of active exploitation cautiously unless JetBrains, CISA or a reputable incident-response source publishes verifiable confirmation.
CVE-2026-63077 at a glance
| Item | Details |
|---|---|
| Product | JetBrains TeamCity On-Premises |
| Vulnerability | Unauthenticated remote code execution |
| Root-cause class | Deserialization of untrusted data |
| Protocol | TeamCity agent polling protocol |
| CVSS | 9.8 Critical, JetBrains CNA score |
| Authentication required | No |
| User interaction required | No |
| Network precondition | HTTP(S) reachability to the TeamCity server |
| Fixed releases | 2025.11.7 and 2026.1.3 |
| Alternative mitigation | JetBrains security patch plugin for TeamCity 2017.1+ |
| TeamCity Cloud | No customer action required for this CVE |
| Confirmed active exploitation | Not established by the authoritative sources checked for this article |
What the flaw allows
JetBrains says an unauthenticated attacker with network access to a TeamCity server can exploit the agent polling protocol and execute arbitrary operating-system commands under the TeamCity server process account.
The vulnerability is tracked as CWE-502: Deserialization of Untrusted Data. The CVE record carries JetBrains’ CVSS 3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
That translates to a remotely reachable flaw with low attack complexity, no required privileges and no user interaction.
The CI/CD context makes the impact more serious than ordinary host compromise. Depending on configuration, a TeamCity server may have access to repository credentials, build settings, package or artifact systems, deployment secrets and downstream environments.
JetBrains specifically warns that successful exploitation could expose TeamCity data, configurations and stored credentials, modify server state and compromise the integrity of build artifacts and downstream CI/CD pipelines.
Which versions are affected?
JetBrains says CVE-2026-63077 affects TeamCity On-Premises and is fixed in:
- TeamCity 2026.1.3
- TeamCity 2025.11.7
The NVD record describes the vulnerable range as TeamCity releases before those fixed builds.
JetBrains also provides a dedicated security patch plugin for installations running TeamCity 2017.1 or newer when a full upgrade cannot be completed immediately.
For the patch plugin:
- TeamCity 2017.1 through 2018.1 requires a server restart after installation.
- From 2018.2 onward, the plugin can be enabled without restarting the server.
- TeamCity 2024.03 and newer can automatically download available security patch plugins and surface them under the administration update interface.
JetBrains still recommends a full product update where possible because the July maintenance releases include additional security fixes beyond CVE-2026-63077.
TeamCity Cloud is different
JetBrains says TeamCity Cloud customers do not need to take action for CVE-2026-63077 because the necessary protections were already applied.
The company also said it had found no evidence that TeamCity Cloud environments had been exploited through this vulnerability when it published the advisory.
That does not make exposed self-hosted TeamCity servers low risk. It only means the vendor-managed service was already remediated.
Exploitation status: what is actually confirmed
At the time of JetBrains’ July 27 advisory, the company said it was not aware of active exploitation.
The NVD record checked for this article includes JetBrains’ critical score and CISA ADP metadata, but it does not itself establish a later exploitation event. Fresh reputable coverage also continues to cite the vendor’s no-known-exploitation status rather than presenting a confirmed campaign with attribution, indicators or scale.
That distinction matters. A vulnerability can deserve urgent patching without being confirmed as actively exploited.
For CVE-2026-63077, the technical severity alone justifies rapid remediation: it is unauthenticated, network reachable and lands directly on a privileged CI/CD control plane.
What administrators should do now
1. Upgrade to a fixed release
Move to 2026.1.3 or 2025.11.7 as soon as practical.
If a full upgrade cannot be completed immediately, apply JetBrains’ security patch plugin. The plugin addresses this specific vulnerability but does not replace the broader security fixes included in current maintenance releases.
2. Reduce TeamCity network exposure
JetBrains recommends restricting TeamCity server access to trusted networks wherever possible.
An internet-facing TeamCity login page, REST endpoint or other HTTP(S)-reachable surface gives a remote attacker the prerequisite needed to attempt this flaw. VPN access, reverse-proxy restrictions, firewall allowlists and segmentation can reduce exposure, but they are defense-in-depth measures rather than substitutes for patching.
3. Minimize TeamCity service-account privileges
Commands run with the privileges of the TeamCity server process. Excessive host permissions therefore expand the potential post-exploitation blast radius.
Run the TeamCity service with the minimum operating-system privileges required for normal operation. JetBrains also recommends hosting the TeamCity server on a dedicated system separate from build agents.
4. Review exposed systems for suspicious activity
Even without confirmed widespread exploitation, administrators of vulnerable internet-reachable systems should review logs and host telemetry around the exposure window.
Useful areas to inspect include:
- unexpected child processes spawned by the TeamCity service;
- newly created or modified TeamCity users and permissions;
- unexplained build-step or project configuration changes;
- suspicious agent configuration changes;
- unusual outbound connections;
- changes to artifact-publishing or deployment behavior;
- unexpected access to repository, package registry, cloud or deployment credentials.
Do not treat generic anomalies as proof of exploitation; correlate them with host, network and application evidence.
5. Rotate credentials if compromise is suspected
A TeamCity compromise can become a software-supply-chain incident if an attacker gains access to credentials used for source control, package publishing, cloud deployment or signing.
If forensic evidence indicates compromise, rotate affected credentials according to the organization’s incident-response and key-management procedures. High-value examples include SCM tokens, deploy keys, artifact repository credentials, package publishing tokens, cloud credentials and signing-service credentials.
Why TeamCity deserves fast patching even without confirmed exploitation
CI/CD systems occupy an unusually sensitive position in the software supply chain. A compromised server can affect not only the host itself but also the code, artifacts and releases trusted by downstream systems and customers.
An attacker with TeamCity-level execution may be able to modify build logic, steal deployment credentials, tamper with artifacts or alter release workflows depending on the privileges available to the server.
Earlier TeamCity vulnerabilities have been exploited in real-world attacks, but that history should not be used as evidence that CVE-2026-63077 is currently being exploited. It is relevant for a narrower reason: TeamCity is a known high-value target, and defenders should not wait for public attribution before fixing a critical unauthenticated RCE.
Confirmed facts
The following claims are directly supported by JetBrains and the CVE record:
- CVE-2026-63077 enables unauthenticated command execution through the TeamCity agent polling protocol.
- JetBrains assigns a CVSS 3.1 score of 9.8.
- TeamCity 2025.11.7 and 2026.1.3 contain the fix.
- A security patch plugin is available for TeamCity 2017.1+.
- TeamCity Cloud customers do not need to patch this issue themselves.
- JetBrains said it was not aware of active exploitation when the vulnerability was disclosed.
The sources checked for this article do not support confidently attributing exploitation to a named threat actor or claiming a known exploitation scale. Those claims should be added only if authoritative evidence emerges.
Sources
Comments
Sign in to join the discussion!
Your comments help others in the community.