Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In

CVE-2026-63077

July 28, 2026 · The Hacker News · Severity: CRITICAL

JetBrains has issued an urgent warning to users of on-premise versions of TeamCity to update their software following the discovery of a critical vulnerability, CVE-2026-63077, with a CVSS score of 9.8. This flaw, discovered by Antoni Tremblay on July 10, 2026, allows unauthenticated attackers to bypass authentication checks and execute arbitrary operating system commands on the TeamCity server. The vulnerability affects all TeamCity On-Premises versions but has been patched in versions 2025.11.7 and 2026.1.3, while TeamCity Cloud instances have already been updated. JetBrains has also released a security patch plugin for versions 2017.1+ to help users who cannot immediately upgrade. The exploitation of this vulnerability could lead to severe consequences, including unauthorized access to TeamCity data, configurations, and stored credentials, as well as potential modifications to the server state. Although there is no evidence of active exploitation, JetBrains strongly recommends upgrading to the latest version or applying the security patch plugin to mitigate the risk. Additionally, the company advises users to implement extra security measures, such as requiring VPN connections or restricting internet-facing TeamCity servers, to reduce exposure to potential attacks. This vulnerability underscores the importance of timely updates and robust security practices to protect sensitive systems and data.

JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already been updated. JetBrains has credited Antoni Tremblay with discovering and reporting the flaw on July 10, 2026. "If exploited, this flaw may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process," JetBrains said. The flaw allows unauthenticated remote code execution via the agent polling protocol to sidestep authentication checks and achieve command execution. Depending on the privileges granted to the TeamCity server process, a successful compromise can lead to the exposure of TeamCity data, configurations, and stored credentials, or modification of server state. Besides releasing versions 2025.11.7 and 2026.1.3, JetBrains has released a security patch plugin for versions 2017.1+ so that customers who are unable to apply an update can still patch their environments. There is no evidence to indicate that the flaw has been exploited in the wild. "The security patch plugin will address only the vulnerability described above (CVE-2026-63077)," JetBrains cautioned. "We always recommend upgrading your server to the latest version to benefit from many other security updates." As best practices, customers are advised to consider requiring VPN connections or implementing an extra layer of security to prevent unauthorized access to internet-facing TeamCity servers. "Even exposing the TeamCity login screen or REST API can provide attackers with potential entry points to exploit newly disclosed vulnerabilities," it added. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Key Takeaways

JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the.