JetBrains has disclosed a significant security flaw in its TeamCity On-Premises software, known as CVE-2026-63077. This vulnerability enables unauthorized users to execute arbitrary commands remotely, posing a major threat to affected systems.
Details of the Security Flaw
The vulnerability impacts all versions of TeamCity On-Premises, allowing attackers with HTTP or HTTPS access to exploit systems without needing valid credentials. The issue lies within the TeamCity agent polling protocol, which can be manipulated to bypass authentication and execute commands with the same permissions as the TeamCity server.
This breach could have severe implications for businesses using TeamCity to manage their software development processes. Unauthorized access could lead to the exposure of sensitive information, modification of build settings, and even the insertion of malicious code into software releases.
Response and Mitigation Efforts
JetBrains has responded by releasing patched versions, 2025.11.7 and 2026.1.3, of TeamCity. Immediate installation of these updates is strongly recommended. Alternatively, organizations can deploy a security patch plugin compatible with versions from 2017.1 onwards, although this is only a temporary measure.
For systems running TeamCity versions 2024.03 and later, the platform supports automated security patch downloads and notifications. Additionally, JetBrains reports that TeamCity Cloud users do not need to take action as existing protections are in place.
Recommendations for Enhanced Security
JetBrains advises restricting TeamCity server access to trusted environments and considering additional security measures like VPNs or other access control layers. Running the TeamCity service with minimal permissions and isolating servers from build agents can further reduce risk.
Despite no current evidence of exploitation, the potential for remote code execution without authentication makes it imperative for organizations to implement the recommended updates and security practices promptly.
JetBrains continues to monitor the situation closely, urging administrators to take proactive steps in securing their TeamCity installations and ensuring that all components are up-to-date.
