Full Report
JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already
Analysis Summary
# Vulnerability: Critical Unauthenticated Remote Code Execution in TeamCity
## CVE Details
- **CVE ID:** CVE-2026-63077
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Authentication Bypass / Command Injection (Specifically relating to the agent polling protocol)
## Affected Systems
- **Products:** JetBrains TeamCity On-Premises
- **Versions:** All versions prior to 2025.11.7 and 2026.1.3.
- **Configurations:** Systems exposed to the internet or accessible via HTTP(S) without additional network-level security layers (like VPN or WAF).
## Vulnerability Description
CVE-2026-63077 is a critical vulnerability within the TeamCity agent polling protocol. It allows an unauthenticated remote attacker to bypass standard authentication checks. By interacting with the polling mechanism, the attacker can execute arbitrary operating system commands with the same privileges as the TeamCity server process. This can lead to full server compromise, including the theft of source code, service credentials, and build configurations.
## Exploitation
- **Status:** Not exploited in the wild (as of the report date); no public PoC mentioned.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Exposure of data, configurations, and stored credentials)
- **Integrity:** High (Modification of server state and build processes)
- **Availability:** High (Potential for full system takeover or service disruption)
## Remediation
### Patches
Update to one of the following versions immediately:
- **TeamCity 2025.11.7**
- **TeamCity 2026.1.3**
- *Note: TeamCity Cloud instances have already been patched by JetBrains.*
### Workarounds
- **Security Patch Plugin:** For users on version 2017.1+ who cannot perform a full upgrade, JetBrains has released a dedicated security plugin: `hxxps[://]download[.]jetbrains[.]com/teamcity/plugins/internal/fix_CVE_2026_63077[.]zip`
- **Network Isolation:** Restrict access to the TeamCity server via VPN or IP allowlisting to prevent exposure to the public internet.
## Detection
- **Indicators of compromise:** Monitor system logs for unusual child processes spawning from the TeamCity server process or unexpected commands executed by the service account.
- **Detection methods and tools:** Audit web access logs for anomalous requests directed at the agent polling endpoints from unrecognized IP addresses.
## References
- JetBrains Official Blog: `hxxps[://]blog[.]jetbrains[.]com/teamcity/2026/07/cve-2026-63077/`
- Security Patch Plugin: `hxxps[://]download[.]jetbrains[.]com/teamcity/plugins/internal/fix_CVE_2026_63077[.]zip`
- News Source: `hxxps[://]thehackernews[.]com/2026/07/critical-teamcity-flaw-could-let[.]html`