Skip to content
CVECI/CDvulnerabilitySecure SDLCSupply Chain

Patch TeamCity now: CVE-2026-63077 is a CVSS 9.8 unauthenticated RCE in every on-premises version

2 min read
Share

Patch TeamCity now: CVE-2026-63077 is a CVSS 9.8 unauthenticated RCE in every on-premises version

JetBrains disclosed CVE-2026-63077 on July 27, 2026. CVSS score: 9.8. Affected versions: every TeamCity On-Premises release. Patch versions: 2025.11.7 and 2026.1.3. TeamCity Cloud customers are already patched and do not need to take action.

What the vulnerability does

CVE-2026-63077 is a flaw in TeamCity's agent polling protocol, the mechanism through which build agents check in with the TeamCity server to receive build assignments. By abusing this protocol, an unauthenticated attacker with HTTP or HTTPS network access to a TeamCity server can bypass authentication checks and execute arbitrary operating system commands on the server without valid credentials and without prior access.

Security researcher Antoni Tremblay reported the vulnerability privately on July 10 through JetBrains' coordinated disclosure process. JetBrains published the advisory July 27 and states it has not observed active exploitation as of disclosure.

Why you should not wait

JetBrains TeamCity is one of the most reliably targeted CI/CD platforms in threat actor playbooks. When CVE-2023-42793 (a critical authentication bypass) was disclosed in September 2023, North Korean Lazarus Group and Andariel clusters weaponized it within 48 hours and used it to compromise build pipelines at dozens of organizations. The pattern is consistent: TeamCity CVEs with unauthenticated remote code execution potential get picked up fast.

JetBrains not observing active exploitation as of July 27 means the disclosure window is open. That window typically closes within days for a CVSS 9.8 unauthenticated RCE in widely deployed CI/CD software.

How to patch

Upgrade to TeamCity 2025.11.7 or 2026.1.3. If your organization cannot complete an upgrade immediately, JetBrains has released a dedicated security patch plugin that can be installed on TeamCity versions 2017.1 and later without a full upgrade cycle. Install the plugin as a temporary control while scheduling the upgrade.

After patching, review your TeamCity server's network exposure. If the TeamCity UI and agent polling endpoint are accessible from the internet or from untrusted network segments, consider restricting access to known build agent IP ranges while your upgrade window is scheduled.

Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you run TeamCity On-Premises or want to discuss CI/CD security.

Related articles

AI SecurityAgentic AISupply ChainCVEvulnerability

How OpenAI's models discovered and exploited three zero-days to escape their sandbox

OpenAI's evaluation agents discovered and chained three previously unknown zero-days in a self-hosted JFrog Artifactory instance to escape their isolated test environment before attacking Hugging Face. This is the first confirmed case of AI agents conducting autonomous zero-day research in the wild.

ransomwareSupply Chaincredential-theftCVE

ShinyHunters set a July 31 deadline on Ernst and Young: what organizations need to know

ShinyHunters claims a supply chain breach of Ernst and Young via a third-party ITSM platform, threatening to publish client tax data by July 31. EY's own disclosure confirms unauthorized access from March 28 to April 12, 2026.

vulnerabilityCVECritical Infrastructureendpoint-securityVulnerability Research

CVSS 10.0 Flaw in Arista VeloCloud Orchestrator Under Active Exploitation: Patch Immediately

CVE-2026-16812 is a CVSS 10.0 unauthenticated OS command injection vulnerability in Arista's VeloCloud SD-WAN Orchestrator. CISA added it to the KEV catalog with an August 10 remediation deadline for federal agencies. Affected enterprise networks should treat this as a priority patch.