CVE-2026-63077: Critical TeamCity Flaw Enables Unauthenticated RCE

JetBrains has disclosed a critical vulnerability, CVE-2026-63077, affecting all On-Premises versions of TeamCity, its widely used CI/CD server. The flaw sits in the agent polling protocol and allows an unauthenticated attacker with HTTP(S) access to the server to bypass authentication checks entirely and execute arbitrary operating system commands with the privileges of the TeamCity server process.

What happened

The issue was reported privately to JetBrains by researcher Antoni Tremblay on July 10, 2026, and disclosed under coordinated disclosure once fixes were ready. JetBrains has patched the bug in TeamCity 2025.11.7 and 2026.1.3; TeamCity Cloud instances were already unaffected and required no customer action. As of publication, JetBrains and The Hacker News report no evidence of active exploitation.

For customers who can't upgrade immediately, JetBrains has released a security patch plugin covering versions back to 2017.1, deployable manually or, for TeamCity 2024.03+, automatically. The vendor is also reiterating baseline hardening advice: restrict TeamCity server access to trusted networks, run the server process with minimal OS privileges, and keep build agents on separate hosts from the server itself.

Why it matters

A CI/CD server like TeamCity is not just another application — it's the machine that pulls source code, holds deployment credentials, signs artifacts, and pushes to production. An unauthenticated RCE against that process is close to a worst-case finding: no phishing, no stolen credentials, no insider access needed, just network reachability. Any internet-facing or loosely segmented TeamCity instance is a realistic target the moment technical details or a working exploit circulate, which is the pattern seen with prior TeamCity authentication-bypass flaws such as CVE-2024-23917.

The practical risk isn't limited to the build server itself. Compromise here typically cascades: exposure of stored secrets and credentials, tampering with build configurations, and the ability to inject malicious code into artifacts before they ever reach a release pipeline — a supply-chain foothold, not just a single-host breach.

What to do now

1. 1Identify every TeamCity On-Premises instance in your estate, including forgotten or shadow-IT deployments.
2. 2Upgrade to 2025.11.7 or 2026.1.3, or apply the security patch plugin if an immediate upgrade isn't feasible.
3. 3Restrict inbound access to the TeamCity server and agent-polling endpoint to trusted, segmented networks — it should not be broadly internet-facing.
4. 4Review server process privileges and separate build-agent hosts from the TeamCity server, per JetBrains' own hardening guidance.
5. 5Audit for signs of compromise (unexpected build configuration changes, unfamiliar agents, anomalous process activity) if the instance has been internet-reachable and unpatched.