TeamCity Alert: Unauthenticated Remote Code Execution Puts CI/CD Pipelines at Risk

Introduction

On July 28, 2026, JetBrains disclosed and patched a critical vulnerability (CVE-2026-63077) affecting TeamCity On-Premises, the popular continuous integration and delivery server. With a CVSS score of 9.8, the flaw allows an unauthenticated remote attacker to execute arbitrary commands on the host system by simply reaching the management console via HTTP(S). As of the time of publication, no active exploits have been observed in the wild, but the severity of the impact requires immediate action from DevOps and security teams.

Technical Analysis

The vulnerability resides in the polling mechanism that build agents use to communicate with the TeamCity server. The affected endpoint, exposed by default on the same web interface as the console, does not require authentication to process certain requests. An attacker can send a specially crafted malicious payload, exploiting insufficient validation of incoming data, to achieve command execution at the operating system level with the privileges of the TeamCity process.

Although JetBrains has not released full technical details to prevent the creation of working exploits, the pattern is reminiscent of classic insecure deserialization or command injection vulnerabilities in internal protocols. Since the attack vector is accessible without any authentication (over HTTP or HTTPS), the barrier for an attacker is extremely low: network connectivity to the console port (typically 8111 or 443) is enough to compromise the entire server.

Impact

Successful exploitation grants a malicious actor full control of the TeamCity server and the underlying operating system. The consequences may include:

• Full access to source code repositories, configuration files, stored credentials (tokens, API keys, passwords), and corporate secrets.
• Tampering with CI/CD pipelines, with the ability to inject malicious code directly into build artifacts and deployment processes.
• Lateral movement to other connected systems, such as staging and production environments, container registries, or automation servers.
• Theft of intellectual property and compromise of the integrity of software delivered to customers.

Since TeamCity is often placed in network segments with high privileges, a breach can trigger a domino effect across the entire DevOps infrastructure.

Mitigation

JetBrains has provided two remediation paths:

1. Immediate update
   Install TeamCity versions 2025.11.7 or 2026.1.3, which fix the vulnerability at the root. This is the recommended route for the most comprehensive protection.

2. Security plugin for legacy environments
   For those unable to upgrade immediately (for example, due to dependencies or maintenance windows), a patch plugin has been released compatible with all versions from 2017.1 onward. The plugin addresses only CVE-2026-63077 without introducing other changes.

3. Network and configuration countermeasures

   • Restrict access to the TeamCity console to trusted networks only, for example via firewall, VPN, or reverse proxy with additional authentication.
   • Isolate the TeamCity server from build agents and other components by applying network segmentation.
   • Run the process with a least-privilege account, on dedicated hosts, and without unnecessary administrative access.

These measures reduce the attack surface but do not substitute applying the patch.

FAQ

1. Which versions of TeamCity are affected?

All versions of TeamCity On-Premises prior to the 2025.11.7 and 2026.1.3 releases are vulnerable. Cloud instances have already been updated by JetBrains.

2. Does the vulnerability require credentials to be exploited?

No. It is a pre-authentication flaw: an attacker can act remotely over the console's HTTP(S) port without needing any valid credentials. This makes it particularly dangerous for servers exposed to the Internet.

3. Can I protect myself without installing the update immediately?

Yes, JetBrains provides a security patch plugin for TeamCity 2017.1 and later. However, the definitive solution is upgrading to the fixed versions. In the meantime, it is essential to apply network restrictions and the principle of least privilege.