JetBrains Patches Critical TeamCity Flaw Allowing Server Takeover - Security Affairs

Home Breaking News Hacking Security JetBrains Patches Critical TeamCity Flaw Allowing Server Takeover JETBRAINS PATCHES CRITICAL TEAMCITY FLAW ALLOWING SERVER TAKEOVER Pierluigi Paganini July 28, 2026 JetBrains patched a critical TeamCity flaw (CVE-2026-63077) enabling unauthenticated code execution on affected on-premise servers. JetBrains has released security updates for TeamCity On-Premises after discovering a critical vulnerability, tracked as CVE-2026-63077 (CVSS score of 9.8). The flaw could allow unauthenticated attackers to execute arbitrary commands on affected servers. All on-premise versions are impacted, while TeamCity Cloud instances have already been patched. Users are advised to upgrade to versions 2025.11.7 or 2026.1.3. “A critical security vulnerability has been identified in TeamCity On-Premises and assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2026-63077.” reads the advisory. “If exploited, this vulnerability may allow an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands.” The TeamCity vulnerability affects servers exposed via HTTP(S) and can be exploited without authentication through the agent polling protocol. An attacker could bypass authentication and execute arbitrary OS commands with TeamCity server privileges, potentially accessing sensitive data, credentials, configurations, altering server settings, and compromising CI/CD pipelines. JetBrains recommends restricting network access, applying least-privilege configurations, and running TeamCity on dedicated hosts separated from build agents. No active exploitation has been observed at disclosure time. The company has also released a security patch plugin for organizations unable to immediately upgrade TeamCity to versions 2025.11.7 or 2026.1.3. The plugin fixes only CVE-2026-63077 and can be installed on TeamCity 2017.1 and later. For newer versions, security patches can be managed directly from the administration console. “The security patch plugin will address only the vulnerability described above (CVE-2026-63077).” continues the advisory.”We always recommend upgrading your server to the latest version to benefit from many other security updates.” JetBrains recommends protecting internet-facing TeamCity servers by requiring VPN access or adding extra security controls. Exposing login pages or REST APIs can provide attackers with potential entry points to exploit newly disclosed vulnerabilities. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-63077) FACEBOOK LINKEDIN TWITTER CVE-2026-63077 Hacking hacking news information security news IT Information Security JetBrains Pierluigi Paganini Security Affairs Security News TeamCity NEWSLETTER Subscribe to my email list and stay up-to-date! RECENT ARTICLES JetBrains Patches Critical TeamCity Flaw Allowing Server Takeover SECURITY / July 28, 2026 We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent. Cookie Settings