A critical unauthenticated remote code execution (RCE) vulnerability has been discovered in TeamCity On-Premises, JetBrains’ widely used continuous integration and continuous delivery (CI/CD) server.
Tracked as CVE-2026-63077, the flaw allows attackers with mere HTTP(S) access to a vulnerable server to bypass authentication entirely and execute arbitrary operating system commands with the privileges of the TeamCity server process.
The flaw resides in TeamCity’s agent polling protocol, a mechanism agents use to communicate with the central server.
Critical TeamCity Flaw
By abusing this protocol, an unauthenticated attacker can sidestep authentication checks and achieve command execution without needing valid credentials or prior access.
Given TeamCity’s central role in software build pipelines, successful exploitation could expose TeamCity data, configurations, and stored credentials, while also allowing modification of server state and build configurations.
More alarmingly, it could compromise the integrity of build artifacts and open the door to poisoning downstream CI/CD pipelines, raising the risk of broader software supply-chain attacks.
All TeamCity On-Premises versions are affected by this issue. TeamCity Cloud customers do not need to take any action, as JetBrains has already applied protective measures on the cloud side.
Security researcher Antoni Tremblay privately reported the vulnerability to JetBrains on July 10, 2026, following coordinated disclosure practices.
JetBrains published its advisory on July 27, 2026, stating that it has no evidence of active exploitation at the time of release, though the unauthenticated nature of the flaw makes rapid weaponization likely once details circulate further.
Patches
JetBrains has released fixes in versions 2025.11.7 and 2026.1.3, and is urging all on-premises users to update immediately.
For organizations unable to upgrade right away, JetBrains has also issued a standalone security patch plugin compatible with TeamCity 2017.1 and later versions.
For TeamCity 2024.03 and newer, the server automatically detects and notifies administrators of the available security patch through Administration | Updates.
Versions between 2017.1 and 2018.1 require a server restart after installing the plugin, while versions from 2018.2 onward support enabling the plugin without any restart.
Mitigation
Beyond patching, JetBrains is advising longer-term hardening measures for internet-facing TeamCity deployments, since even exposing the login screen or REST API can give attackers a foothold for exploiting newly disclosed flaws. Recommended best practices include:
- Requiring VPN access for internet-facing TeamCity servers instead of direct exposure.
- Restricting network access to trusted networks wherever feasible.
- Running the TeamCity server process with minimum necessary OS privileges.
- Hosting TeamCity servers on dedicated infrastructure, separate from build agents.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
 vulnerability has been discovered in TeamCity On-Premises, JetBrains' widely used continuous integration and continuous delivery (CI/CD) server.){kind=link}