JetBrains has announced the release of essential security updates for TeamCity On-Premises, addressing a critical vulnerability that risks unauthorized operating system command execution by remote attackers.
Vulnerability Details and Affected Versions
The security flaw, identified as CVE-2026-63077, impacts all TeamCity On-Premises versions. JetBrains has rectified the issue in versions 2025.11.7 and 2026.1.3. For administrators unable to upgrade immediately, a security patch plugin is available for TeamCity versions 2017.1 and later.
This vulnerability was privately disclosed by security expert Antoni Tremblay on July 10, 2026, through JetBrains’ coordinated disclosure process. While there have been no reports of active exploitation, the flaw permits unauthenticated remote code execution on TeamCity servers accessible via HTTP or HTTPS.
Exploitation Risks and Impact
Exploiting the TeamCity agent polling protocol, attackers can bypass authentication to execute commands with the TeamCity server’s permissions. This could jeopardize software development environments by exposing project data, server configurations, and sensitive credentials.
The severity of this vulnerability scales with the operating system permissions granted to the TeamCity service account, potentially compromising connected infrastructure if run with elevated privileges. Organizations using TeamCity for critical operations should prioritize patching.
Recommendations for Mitigating Risk
JetBrains advises upgrading affected TeamCity installations to versions 2025.11.7 or 2026.1.3 via manual download or automatic update features. The released versions fully resolve CVE-2026-63077, and a security patch plugin is also made available for those unable to upgrade promptly.
Administrators should enable automatic security patch plugin downloads and reviews, available from TeamCity version 2024.03. For installations between 2017.1 and 2018.1, server restarts are necessary post-plugin installation, while later versions allow enabling without a restart.
JetBrains emphasizes the importance of regular updates, as the plugin only addresses CVE-2026-63077. TeamCity Cloud customers are already protected by pre-applied security measures.
Enhancing Security Practices
To bolster security, JetBrains recommends limiting TeamCity access to trusted networks, using VPNs, or additional access controls for internet-facing instances, and operating with minimal necessary privileges. Additionally, hosting TeamCity servers separately from build agents can help mitigate potential compromise impacts.
