Critical TeamCity flaw enables unauthenticated operating system command execution

On July 28, 2026, JetBrains disclosed CVE-2026-63077, a critical vulnerability with a CVSS score of 9.8 affecting every version of TeamCity On-Premises. The company fixed the issue in TeamCity 2025.11.7 and 2026.1.3, while TeamCity Cloud environments have already been updated.

Why the vulnerability presents a serious risk

An attacker with HTTP(S) access to a vulnerable server can exploit the agent polling protocol to bypass authentication and execute arbitrary operating system commands. No valid TeamCity account or prior access to the environment is required.

The resulting impact depends on the privileges assigned to the TeamCity server process. A successful compromise could expose project data, server configurations, and stored credentials or allow an attacker to alter the server state. Because TeamCity forms part of many CI/CD pipelines, such access may also undermine the integrity of software delivery operations.

Affected versions and available fixes

Security researcher Antoni Tremblay discovered the flaw and reported it to JetBrains on July 10, 2026. JetBrains has found no evidence that CVE-2026-63077 has been exploited in the wild, but the absence of observed attacks does not reduce the urgency of remediation.

“If exploited, this flaw may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.”

Organizations should upgrade to version 2025.11.7 or 2026.1.3. For installations running TeamCity 2017.1 or later that cannot be updated immediately, JetBrains has released a security patch plugin. The plugin addresses only CVE-2026-63077, so it is not a substitute for installing the latest release and its broader security fixes.

For businesses, the practical response is to inventory every TeamCity On-Premises instance, patch it without delay, and review whether the server is reachable from the internet. Requiring VPN access or adding another security layer reduces exposure; even a publicly accessible login screen or REST API can provide an entry point for newly disclosed vulnerabilities.