Critical TeamCity CVE-2026-63077 RCE Flaw Enables Unauthenticated Server Takeover

A critical remote code execution (RCE) vulnerability affecting JetBrains TeamCity On-Premises has prompted urgent warnings for organizations relying on the popular continuous integration and continuous delivery (CI/CD) platform.

Tracked as CVE-2026-63077, the flaw enables unauthenticated attackers to execute arbitrary operating system commands on vulnerable TeamCity servers, potentially leading to complete compromise of software development pipelines.

Because TeamCity is widely used to automate application builds, testing, and deployments, exploitation of this vulnerability could have severe consequences, including supply chain attacks, credential theft, and unauthorized modification of software artifacts.

Critical TeamCity CVE-2026-63077 RCE Flaw

According to JetBrains, the vulnerability impacts all TeamCity On-Premises versions prior to the recently released security updates.

The flaw has been assigned a critical severity due to the fact that attackers require only HTTP or HTTPS connectivity to a vulnerable server to exploit the issue.

No valid credentials or prior authentication are necessary, making internet-exposed TeamCity instances particularly attractive targets for cybercriminals and advanced persistent threat (APT) groups looking to infiltrate enterprise development environments.

Technical analysis reveals that CVE-2026-63077 originates within the TeamCity agent polling protocol, where improper authentication validation allows malicious requests to bypass normal access controls.

Once the authentication mechanism is circumvented, attackers can execute arbitrary system commands with the same privileges as the TeamCity server process.

Depending on the server configuration, this level of access may expose sensitive build configurations, API tokens, deployment secrets, SSH keys, source code repositories, and credentials used throughout the software development lifecycle.

The implications extend well beyond the compromise of a single server. Since TeamCity often acts as the central automation platform for software compilation, testing, packaging, and deployment, attackers gaining administrative control could manipulate build pipelines to insert malicious code into trusted applications before release.

Such attacks could silently distribute backdoored software updates to customers, partners, or internal systems, creating a classic software supply chain compromise similar to several high-profile attacks seen in recent years.

Additionally, attackers may modify deployment scripts, disable security checks, steal proprietary source code, or exfiltrate confidential development data without immediate detection.

The vulnerability was responsibly disclosed on July 10, 2026, by security researcher Antoni Tremblay through a coordinated vulnerability disclosure process.

Following its investigation, JetBrains released patched versions 2025.11.7 and 2026.1.3, both of which fully address the authentication bypass and remote code execution flaw.

For organizations unable to immediately upgrade due to operational constraints, JetBrains has also released a dedicated security patch plugin compatible with TeamCity versions dating back to 2017.1.

While the plugin mitigates CVE-2026-63077, the vendor strongly recommends upgrading to the latest supported release to benefit from additional security improvements, performance enhancements, and bug fixes.

JetBrains has confirmed that TeamCity Cloud customers are not affected, as the managed cloud service already includes the necessary protections against this vulnerability.

Furthermore, at the time of public disclosure, there was no evidence of active exploitation in the wild. Nevertheless, security experts warn that critical vulnerabilities affecting internet-facing developer infrastructure are often weaponized rapidly after technical details become available, significantly increasing the risk for organizations delaying remediation.

Security teams should immediately identify all exposed TeamCity servers, apply the latest updates or deploy the temporary security plugin where necessary, and verify that administrative interfaces are not directly accessible from the public internet.

Organizations are also encouraged to restrict access through VPNs, firewall rules, or zero-trust network controls while running the TeamCity service with the minimum operating system privileges required.

Continuous monitoring of authentication logs, build pipeline activity, and system integrity can help detect suspicious behavior following attempted exploitation.

Given TeamCity’s critical role within modern DevSecOps environments, CVE-2026-63077 should be treated as an emergency patching priority.

Prompt remediation, combined with network segmentation and least-privilege security practices, is essential to protect CI/CD infrastructure from unauthorized access, safeguard software supply chains, and prevent attackers from turning trusted development platforms into powerful attack vectors against downstream users and customers.