JetBrains patches critical RCE bug in TeamCity server

JetBrains released patches this week for an unauthenticated remote code execution vulnerability in TeamCity On-Premises, tracked as CVE-2026-63077 with a CVSS score of 9.8. The flaw can be exploited over HTTP/S to bypass authentication and run operating system commands with the privileges of the TeamCity server process.

The advisory states: “An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.” Exploitation may allow access to TeamCity data, configurations and stored credentials, modification of server state, and contamination of build artifacts and downstream CI/CD pipelines.

Fixes are included in TeamCity versions 2025.11.7 and 2026.1.3. JetBrains also published a security patch plugin that supports releases back to 2017.1 for organizations that cannot upgrade immediately. The vendor noted the plugin addresses only CVE-2026-63077 and recommended installing the full updated release when possible.

Mitigations were applied to TeamCity Cloud instances. JetBrains reported no evidence that the vulnerability has been exploited in the wild and is monitoring the situation.

Administrators are advised to apply the patched releases or the security patch plugin as soon as possible, restrict access to internet-facing TeamCity servers, run servers with minimum required operating system privileges, use VPNs or other access controls to block unauthorized connections, and host TeamCity servers on dedicated machines separate from build agents. Organizations that cannot patch immediately should at minimum block incoming HTTP/S connections to agent polling endpoints and audit network and process logs for unusual activity.

TeamCity is a continuous integration and build management server used to run and coordinate builds, tests and deployments. Patched releases and the security plugin are available from JetBrains’ download channels.