- JetBrains has disclosed a critical vulnerability, CVE-2026-63077, affecting all on-premise versions of TeamCity.
- The flaw, with a CVSS score of 9.8, allows an unauthenticated attacker to execute arbitrary code on a vulnerable server.
- Patches are available in versions 2025.11.7 and 2026.1.3, and a security patch plugin is offered for older versions.
JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions and has been addressed in versions 2025.11.7 and 2026.1.3.
JetBrains credited Antoni Tremblay with discovering and reporting the flaw on July 10, 2026. “If exploited, this flaw may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process,” JetBrains said.
Consequently, the flaw allows unauthenticated remote code execution via the agent polling protocol to sidestep authentication checks and achieve command execution. Depending on the privileges granted to the TeamCity server process, a successful compromise can lead to the exposure of TeamCity data, configurations, and stored credentials, or modification of server state.
Besides releasing versions 2025.11.7 and 2026.1.3, JetBrains has released a security patch plugin for versions 2017.1+ so that customers who are unable to apply an update can still patch their environments. There is no evidence to indicate that the flaw has been exploited in the wild.
Meanwhile, JetBrains cautioned that the patch plugin will only address the described vulnerability. As best practices, customers are advised to consider requiring VPN connections or implementing an extra layer of security to prevent unauthorized access to internet-facing TeamCity servers. “Even exposing the TeamCity login screen or REST API can provide attackers with potential entry points to exploit newly disclosed vulnerabilities,” it added.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- India-Indonesia UPI-QRIS link nears launch, bypassing US dollar
- Judge blocks Minnesota’s first-in-nation prediction market ban
- Robinhood to livestream IPO roadshow for Ventures Fund II on Aug. 3
- CZ backs crypto license passporting across ASEAN for easier entry
- Critical Arista VeloCloud Flaw Under Active Attack, Patch Now
