Critical TeamCity Vulnerability: Command Execution Without Authorization

JetBrains has released emergency updates for its TeamCity continuous integration server, fixing a critical vulnerability that allows arbitrary code to be executed without logging in. The issue has been assigned the identifier CVE-2026-63077 and a near-maximum CVSS score of 9.8 out of 10.

What's happening

The vulnerability affects all versions of TeamCity On-Premises — that is, those deployed in the customer's own infrastructure. According to JetBrains' description, an unauthenticated attacker with nothing more than HTTP(S) access to the server can bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity process.

The attack mechanism is tied to the agent polling protocol: it is precisely through this channel that authentication can be sidestepped and command execution reached. The consequences depend on the rights under which the server process runs, but in the worst case they amount to the exposure of TeamCity data, configurations and stored credentials, as well as changes to the server's state.

What to do

The issue has been fixed in versions 2025.11.7 and 2026.1.3. Cloud instances of TeamCity Cloud have already been updated automatically. For those who cannot update their server immediately for whatever reason, JetBrains has released a separate security patch plugin, compatible with versions starting from 2017.1. The company does caution, however, that the plugin closes only this specific vulnerability, whereas a full update also brings a host of other fixes.

As an additional safeguard, it is recommended to restrict access to internet-facing servers — for example, by requiring connections through a VPN or by introducing an extra layer of access control. As JetBrains notes, even an exposed login screen or REST API can become an entry point for exploiting new vulnerabilities.

The flaw was discovered and reported on July 10, 2026 by researcher Antony Tremblay. There are no signs of the vulnerability being exploited in real-world attacks at this time — but given the score of 9.8 and the nature of the bug, putting off the update is clearly not advisable.

Source: The Hacker News