JetBrains patches critical TeamCity flaw enabling unauthenticated code execution

JetBrains released security updates for TeamCity On-Premises to address a critical vulnerability, CVE-2026-63077, which carries a CVSS score of 9.8. This flaw allows unauthenticated attackers to execute arbitrary commands on affected servers, posing a significant risk to users with on-premise installations, according to a recent report by Security Affairs.

The vulnerability, affecting all on-premise versions of TeamCity, can be exploited by an unauthenticated attacker with HTTP(S) access to the server. Attackers can bypass authentication checks and execute arbitrary operating system commands with TeamCity server privileges. This could lead to the compromise of sensitive data, credentials, and configurations, as well as the alteration of server settings and CI/CD pipelines. While TeamCity Cloud instances have already been patched, users of on-premise versions are strongly advised to upgrade to versions 2025.11.7 or 2026.1.3. For those unable to upgrade immediately, JetBrains offers a security patch plugin for TeamCity 2017.1 and later. The company also recommends restricting network access to TeamCity servers and implementing least-privilege configurations to mitigate potential exploitation.

Source: Security Affairs