Critical Vulnerability Discovered in TeamCity On-Premises Solutions
JetBrains, a prominent software development company, has recently brought to light a critical vulnerability affecting its TeamCity On-Premises product. This flaw poses a significant risk, as it allows remote attackers to execute arbitrary operating system commands without the need for authentication. The vulnerability has been assigned the designation CVE-2026-63077 and impacts all versions of TeamCity On-Premises that can be accessed over HTTP or HTTPS.
The vendor’s coordinated disclosure program played a crucial role in identifying this security issue, with security researcher Antoni Tremblay reporting the vulnerability on July 10, 2026. As of now, no evidence has been found indicating that active exploitation of this flaw is occurring.
This authentication bypass vulnerability is particularly concerning because it enables attackers who have HTTP or HTTPS access to circumvent standard authentication measures. Once inside, they can execute commands using the privileges assigned to the TeamCity server process. The exploitation of this vulnerability occurs via the TeamCity agent polling protocol, a process that does not require any user credentials. Consequently, this puts internet-facing installations at an even greater risk, potentially allowing unauthorized parties to gain access to critical data, stored credentials, server configurations, and even sensitive build artifacts within CI/CD pipelines.
In response to this serious issue, JetBrains has rolled out patches for TeamCity On-Premises in versions 2025.11.7 and 2026.1.3. Organizations unable to quickly upgrade their systems have the option to deploy a security patch plugin that is compatible with TeamCity versions 2017.1 and onward. For those using installations from TeamCity version 2024.03 or higher, security patch plugins will automatically download when update alerts are activated. It is important to note that servers operating on versions 2017.1 to 2018.1 will require a restart post-plugin installation, whereas installations from version 2018.2 and up can activate the plugin without a restart.
For TeamCity Cloud customers, the situation is less dire; they need not take any immediate action since JetBrains has already implemented necessary protections in cloud environments. Furthermore, the vendor has assured users that no exploitation has been observed within these cloud deployments. Although the security patch plugin specifically addresses CVE-2026-63077, JetBrains has advised organizations to conduct a full upgrade to access additional security enhancements available in the latest releases.
Given the nature of this vulnerability, administrators are strongly encouraged to prioritize the patching of internet-facing TeamCity servers. Additionally, organizations should consider implementing long-term security measures, such as restricting access to TeamCity On-Premises servers through VPN connections or other protective layers. It is crucial to avoid exposing login pages or REST APIs directly to the internet.
To bolster security further, organizations are recommended to adopt several hardening practices. These include limiting network access to trusted environments, running TeamCity with minimal required operating system privileges, and deploying servers on dedicated hosts that are separated from build agents. Such measures create layers of protection that can significantly reduce the risk of successful exploitation.
Monitoring and maintaining security in software development environments is vital, especially in the context of cloud solutions and remote work scenarios that have become increasingly prevalent. With the rapid evolution of threats faced by organizations, staying up-to-date on security practices and addressing vulnerabilities promptly is essential for safeguarding sensitive data and maintaining the integrity of CI/CD processes.
In conclusion, JetBrains’ revelation of the CVE-2026-63077 vulnerability in TeamCity On-Premises highlights the importance of vigilance in software security. As attackers become more sophisticated, organizations must proactively respond to potential threats by prioritizing software updates, implementing stringent access controls, and employing comprehensive security measures. Only through these actions can they hope to mitigate risks and protect their development environments from unauthorized access and catastrophic breaches.