JetBrains has patched a critical TeamCity vulnerability that could allow unauthenticated attackers to run operating system commands on exposed, self-hosted servers. The company disclosed CVE-2026-63077 on July 27, 2026, and released fixes in TeamCity 2025.11.7 and 2026.1.3.
The flaw affects unpatched TeamCity On-Premises servers reachable over HTTP or HTTPS. A successful attack could expose credentials, alter server configurations, or compromise software moving through connected build and deployment pipelines. TeamCity Cloud customers do not need to take action.
JetBrains releases emergency TeamCity fixes
In a security advisory, JetBrains said attackers could exploit the TeamCity agent polling protocol without authenticating. Successful exploitation could bypass access controls and execute commands with the privileges assigned to the TeamCity server process.
Security researcher Antoni Tremblay privately reported the flaw to JetBrains on July 10, 2026, through the company’s coordinated disclosure process. JetBrains said it was unaware of active exploitation when it published the advisory.
Administrators should upgrade to TeamCity 2025.11.7 or 2026.1.3 as soon as possible. Each maintenance release fixes CVE-2026-63077 and more than 20 other security vulnerabilities. Updates are available through TeamCity’s automatic updater, direct downloads, and updated Docker images.
Organizations unable to complete a full upgrade immediately can install JetBrains’ security patch plugin on TeamCity 2017.1 or later. The plugin fixes only CVE-2026-63077. Versions 2017.1 through 2018.1 require a restart after installation, while versions 2018.2 and later can enable it without restarting.
Until the fix is installed, administrators should restrict TeamCity to trusted networks or require a VPN or another authenticated access layer. Network controls reduce exposure but do not replace patching. JetBrains also recommends running the server with minimal operating system privileges and keeping it on a separate host from build agents.
Compromised pipelines can extend the damage
TeamCity may connect to source-code repositories, build agents, credentials, artifact stores, signing systems, and deployment infrastructure. Recent attacks targeting developer credentials show how a compromised administrative platform can expose connected systems.
Depending on the TeamCity process’s permissions, attackers could steal data, alter server state, or tamper with build artifacts and downstream pipelines. Stolen tokens present another risk because they may provide access to private repositories and organizational code, as a recent GitHub token vulnerability illustrated.
Earlier TeamCity vulnerabilities also show why patching should not wait for confirmed attacks. A joint US and UK cybersecurity advisory documented Russian Foreign Intelligence Service exploitation of CVE-2023-42793 in 2023. CISA later added CVE-2024-27198 to its Known Exploited Vulnerabilities catalog after confirming exploitation.
Those incidents do not establish that CVE-2026-63077 is under active attack. They show why exposed infrastructure warrants prompt attention, particularly as vulnerability exploitation becomes a leading initial-access method.
JetBrains’ advisory does not include indicators of compromise specific to CVE-2026-63077. After patching, security teams should review network exposure, unexpected processes, configuration changes, user accounts, tokens, credentials, and recent build artifacts.
Where compromise cannot be ruled out, teams should preserve forensic evidence before rebuilding the server. They should also rotate high-value credentials and validate builds and releases produced while the server was vulnerable and exposed.
Read more: Confirming that updates reached every affected system is as important as deploying them, particularly when an actively exploited Linux vulnerability remains present on unpatched infrastructure.