JetBrains has issued a security advisory for a critical vulnerability affecting TeamCity On-Premises. Tracked as CVE-2026-63077, the issue can be exploited to bypass authentication and ultimately achieve TeamCity remote code execution, letting an attacker run arbitrary operating system commands under the privileges of the TeamCity server process.
Because TeamCity is widely used to build, test, and deploy software, weaknesses in the platform can have serious downstream impact on data, stored secrets, and the integrity of CI/CD workflows. Here’s what administrators need to know and what actions to take immediately.
What CVE-2026-63077 allows attackers to do
According to JetBrains, the vulnerability involves an authentication bypass. An attacker with HTTPS access to a TeamCity server may be able to exploit the agent polling protocol to bypass authentication.
Once authentication controls are circumvented, the attacker can execute arbitrary commands on the underlying operating system. The commands would run with the same permissions as the TeamCity server process, which can vary based on how the service is configured and deployed.
All On-Premises versions are affected
JetBrains states that all versions of TeamCity On-Premises are impacted. That means there is no “safe” version on-prem users should assume is protected by default.
At the same time, JetBrains clarifies that TeamCity Cloud customers are not required to take any action, because the necessary remediation measures have already been applied.
Why this is especially risky for CI/CD environments
TeamCity is a commercial CI/CD server used by teams to automate software delivery. When a server like this is compromised, the attacker may gain more than just access to the host machine.
JetBrains notes that if CVE-2026-63077 is successfully exploited, the attacker could expose TeamCity data, configurations, and stored credentials. Depending on the privileges the attacker gains, it may also be possible to compromise build artifacts and even CI/CD pipelines—which is one of the most concerning outcomes for organizations relying on automated deployments.
In practice, that means a single foothold can translate into tampered builds or unauthorized code paths moving through the delivery process.
Is there evidence of active exploitation?At the time JetBrains published the advisory (July 27), the vendor reported no evidence of active exploitation. However, JetBrains also emphasizes that TeamCity vulnerabilities have been leveraged extensively in the past—by both ransomware groups and state-backed actors.
That history is why the recommendation is clear: administrators should treat this as urgent even if no confirmed exploitation is currently visible.
Immediate mitigation steps recommended by JetBrains
JetBrains provides a clear remediation path, starting with upgrading to fixed releases. If upgrading isn’t feasible right away, there’s also a security plugin option for older versions.
1) Upgrade to the patched TeamCity versions
The vendor’s first option is to upgrade to versions where the issue was addressed: 2025.11.7 and 2026.1.3. JetBrains explains that the problem was privately reported on July 10, and fixes were delivered in those releases.
If you manage multiple environments, prioritize the systems that are most accessible or critical to production deployments. Reducing exposure first can lower the risk window while you complete the upgrade cycle.
2) Use the security patch plugin when you can’t upgrade
For customers unable to move to the latest releases, JetBrains offers a security patch available for TeamCity 2017.1+ as a plugin.
JetBrains also notes version-specific behavior for patch automation:
- TeamCity 2024.03 and newer will automatically download available security patch plugins and notify administrators to install them.
- TeamCity versions 2017.1 through 2018.1 will require a server restart for the security updates to take effect after installing the patch plugin.
JetBrains indicates that detailed installation instructions are available from the vendor’s guidance. Administrators should follow those steps carefully to ensure the plugin is correctly installed and activated.
Harden internet-facing servers to reduce attack paths
In addition to patching, JetBrains highlights broader defensive measures. One key recommendation is to add protective layers such as VPN access or other controls for TeamCity instances exposed to the internet.
JetBrains also warns that attackers can use multiple entry points. Even if the login page or REST API is all that’s exposed externally, that still may provide a path to exploit newly disclosed vulnerabilities.
So the goal should be more than “patch and hope.” You should assume that exposure increases risk, and every exposed surface can reduce an attacker’s effort to reach the vulnerable components.
Validate controls: “test every layer before attackers do”
JetBrains’ advisory includes a security perspective that applies beyond this single bug. Many environments believe they are protected because alerts exist. However, attackers often move in ways that aren’t detected.
JetBrains references the idea that only a small fraction of successful attacks trigger alerts in typical monitoring setups, implying that the rest can proceed without triggering immediate detection. Their point is that teams should test and verify the effectiveness of the monitoring stack.
For organizations running CI/CD workloads, this validation matters even more. You need to confirm that your SIEM and EDR tooling, alerting rules, and incident response workflows actually detect suspicious activity that resembles real exploitation attempts.
What to do next: a practical checklist
If you administer TeamCity On-Premises, consider the following immediate actions:
- Confirm your deployment type: TeamCity Cloud requires no action, but On-Premises needs remediation.
- Identify your exact TeamCity version: determine whether you can upgrade to 2025.11.7 or 2026.1.3.
- Plan the fastest safe upgrade: prioritize systems with internet exposure or high operational criticality.
- If upgrading isn’t possible, install the security patch plugin for TeamCity 2017.1+.
- Apply operational requirements: for versions 2017.1–2018.1, schedule a restart after plugin installation.
- Reduce exposure: use VPN and other layers for any internet-facing TeamCity servers.
- Re-check exposed surfaces: treat both the login page and REST API as potential entry points.
- Test detection and response: validate that your monitoring stack can identify anomalous behavior related to authentication bypass and command execution attempts.
Conclusion
CVE-2026-63077 is a serious vulnerability with the potential for TeamCity remote code execution on TeamCity On-Premises systems. JetBrains reports no evidence of active exploitation at publication time, but the potential impact on CI/CD pipelines, stored credentials, and build artifacts makes fast action essential.
Upgrade to 2025.11.7 or 2026.1.3 when possible, or apply the vendor’s security plugin for supported older versions. Pair remediation with hardening—especially for any internet-facing instances—and validate that your security monitoring can catch suspicious activity before attackers do.
