Critical TeamCity Vulnerability Exposes Servers to Unauthenticated Remote Code Execution Attacks

DNI SUMMARY — KEY POINTS

• JetBrains has issued an urgent security warning regarding a critical remote code execution vulnerability identified as CVE-2026-63077 affecting its TeamCity On-Premises platform.
• This high-severity flaw carries a CVSS score of 9.8 and allows unauthenticated attackers to execute arbitrary operating system commands on vulnerable servers.
• The vulnerability resides within the agent polling protocol used for communication between build agents and the primary TeamCity server infrastructure.
• Independent security researcher Antoni Tremblay initially discovered the flaw on July 10, prompting an immediate response from the JetBrains engineering team.
• Organizations using self-hosted TeamCity instances are strongly advised to update to version 2025.11.7 or 2026.1.3 or apply the released security plugin immediately.

Software developer JetBrains has officially confirmed the existence of a critical vulnerability in its TeamCity On-Premises environment that poses a significant risk to organizations relying on the platform for their CI/CD pipelines. Labeled as CVE-2026-63077, the flaw enables unauthenticated attackers to gain unauthorized access to servers simply by sending specially crafted HTTP or HTTPS requests. With a CVSS score of 9.8, this vulnerability sits at the top tier of severity, granting potential intruders the ability to execute arbitrary operating system commands with the privileges of the underlying server process.

Technical Root of Vulnerability

The technical root cause of this security failure lies deep within the agent polling protocol, a component designed to handle essential communication between build agents and the central server. By exploiting this mechanism, an attacker can bypass authentication checks entirely, effectively turning a legitimate management tool into a gateway for full system compromise. This means that any actor with network access to the target server can potentially manipulate build configurations, steal sensitive deployment credentials, or pivot laterally through internal networks to inflict further damage on infrastructure.

While the discovery presents a major headache for system administrators, the cloud-based iteration of the service remains unaffected by these specific security gaps. Daniel Gallo, a solutions engineer at the company, clarified that necessary mitigations had already been deployed to the managed service environment prior to the public disclosure. Consequently, users of TeamCity Cloud do not need to perform manual updates, though this does not alleviate the burden on those running their own private, self-hosted instances that remain exposed to the public internet.

Mitigation and Patching Strategies

The vulnerability was brought to light by security researcher Antoni Tremblay, who responsibly disclosed the flaw on July 10, giving the developer time to verify the threat and prepare a robust remediation strategy. In response, the company has released updated versions of the software—specifically 2025.11.7 and 2026.1.3—which contain the necessary code fixes to neutralize the threat. For legacy users who cannot perform a full system upgrade, a security patch plug-in has also been provided to protect older versions dating back to 2017.1.

Cybersecurity experts have been quick to weigh in on the situation, emphasizing that simple patching is only one part of a comprehensive defensive posture. Firms like Rapid7 are urging administrators to treat this update with the highest level of priority to prevent potential exploitation. In addition to installing the software patches, security teams are encouraged to implement strict network access controls, ensuring that TeamCity servers are only reachable by trusted internal systems or authenticated users, thereby reducing the attack surface for any potential external threats.

Expert Advice for Infrastructure

Maintaining a secure CI/CD pipeline has never been more difficult, given the increasing sophistication of modern threat actors targeting developer tools. This incident serves as a stark reminder of the risks inherent in self-hosted enterprise software, where responsibility for security updates rests solely with the local IT infrastructure team. As organizations continue to integrate these automation tools into their core workflows, the importance of proactive vulnerability management and rapid response protocols becomes essential to preventing data breaches and maintaining overall corporate network integrity.

There is currently no reported evidence of this vulnerability being actively exploited in the wild, providing a small window of opportunity for administrators to secure their environments. However, the lack of current active exploitation should not lead to complacency, as the technical details of such flaws often find their way into public exploit databases very quickly. Security teams should prioritize this task immediately, as the potential for unauthenticated command execution is a nightmare scenario that could lead to widespread disruption of entire software deployment cycles.

Broader Implications for Security

Looking forward, the incident highlights a broader trend of increased scrutiny over CI/CD toolchains, which have become high-value targets for attackers seeking to inject malicious code into supply chains. The swift disclosure and patch release by the vendor demonstrate a positive commitment to transparency, yet the burden of action remains with the end users to apply these fixes across their production environments. Consistent monitoring and adherence to security advisories remain the best defense against such persistent threats in an increasingly complex and interconnected digital landscape.