Critical Alert for JetBrains TeamCity On-Premises: Patch for Unauthenticated RCE Vulnerability (CVE-2026-63077)

Introduction

On July 29, 2026, JetBrains released an urgent security advisory for all on-premises versions of TeamCity, the well-known continuous integration server. The vulnerability, tracked as CVE-2026-63077 and rated CVSS 9.8 (Critical), enables remote code execution without any authentication. Researcher Antoni Tremblay reported the issue on July 10, 2026, and currently there are no public exploits or active exploitation attempts. TeamCity Cloud instances have already been updated.

Technical Analysis

The flaw lies in the logic of the polling protocol used by build agents to communicate with the server. Under default conditions, this mechanism does not apply sufficient checks on incoming requests, allowing an unauthenticated attacker – provided they can reach the server over HTTP(S) – to invoke internal endpoints. By exploiting this weakness, it is possible to bypass authentication checks and forward arbitrary commands that are executed with the privileges of the TeamCity process at the operating system level.

Impact

An attacker who compromises an on-premises TeamCity server can gain full control of the process, exposing sensitive data such as source code, build configurations, credentials stored in environment variables, and API keys. Moreover, they could alter the server state, modify deployment pipelines, and, in the worst cases, move laterally within the corporate network. The ease of exploitation (no authentication required) makes this vulnerability particularly dangerous for organizations that expose the service on public networks.

Mitigation

JetBrains recommends immediate upgrade to the fixed versions:

• TeamCity 2025.11.7
• TeamCity 2026.1.3

For environments that cannot apply the upgrade right away, a security patch plugin is available, compatible with versions 2017.1 and later. This solution exclusively addresses CVE-2026-63077 and does not include other security improvements: it should be considered a temporary measure.

Additional Best Practices:

• Restrict access to TeamCity servers via VPN or firewall;
• Enable multi-factor authentication for all accounts;
• Do not expose the login screen or REST API of the server to the Internet;
• Monitor logs for anomalous activity related to agent polling.

FAQ

1. What is the CVE-2026-63077 vulnerability? It is a critical flaw (CVSS 9.8) in the agent polling protocol of TeamCity On-Premises. It allows an attacker without credentials to execute arbitrary commands on the server, gaining control of the TeamCity process and potentially the entire host.

2. Which versions of TeamCity are affected? All on-premises installations prior to releases 2025.11.7 and 2026.1.3. Versions 2017.1 and later can receive a temporary fix via the JetBrains security patch plugin. TeamCity Cloud is not at risk because it is centrally updated.

3. How can I check if I have already been compromised? At present, there is no evidence of active attacks exploiting this vulnerability. However, JetBrains recommends reviewing server logs for suspicious requests on agent polling endpoints and running an antivirus scan on critical hosts, then updating the software immediately.