JetBrains has issued an urgent advisory for users of the on-premise TeamCity software, urging them to upgrade to the latest version due to a severe security vulnerability. Known as CVE-2026-63077, this flaw is critical, with a CVSS score of 9.8, indicating its potential to cause significant harm.
Vulnerability Details and Versions Affected
The identified security issue affects all on-premise versions of TeamCity prior to 2025.11.7 and 2026.1.3. These versions have been updated to address the flaw, while TeamCity Cloud instances have already been automatically patched. The vulnerability was discovered by Antoni Tremblay and reported to JetBrains on July 10, 2026.
If exploited, this vulnerability allows an attacker to bypass authentication checks through HTTP(S) access, leading to arbitrary code execution on the server. The attack leverages the agent polling protocol to execute commands with the same privileges as the TeamCity server, potentially compromising sensitive data and server configurations.
Security Patches and Recommendations
In addition to the updated versions, JetBrains has released a security patch plugin for versions 2017.1 and above, offering an interim solution for users unable to update immediately. Importantly, there is no evidence of this vulnerability being exploited in active attacks.
JetBrains emphasizes that the security patch specifically addresses CVE-2026-63077. However, upgrading to the latest version is advised to ensure comprehensive protection against future vulnerabilities and to benefit from other security improvements.
Best Practices for Securing TeamCity
To further protect their systems, JetBrains advises customers to consider additional security measures, such as requiring VPN access for TeamCity servers. Implementing extra layers of security can help prevent unauthorized access, especially for servers exposed to the internet.
Even minimally exposed interfaces like login screens or APIs can serve as potential targets for attackers looking to exploit new vulnerabilities. Therefore, maintaining a robust security posture is crucial to safeguarding enterprise environments.
In conclusion, addressing this critical vulnerability is imperative to protect against unauthorized access and potential data breaches. Users are encouraged to act swiftly to secure their systems by applying the necessary updates or patches.
