JetBrains has released patches for a serious security flaw affecting TeamCity On-Premises. This vulnerability, designated as CVE-2026-63077, carries a high CVSS score of 9.8 and allows unauthenticated attackers to exploit it via HTTP/S. By bypassing authentication checks, attackers can execute arbitrary operating system commands with the privileges of the TeamCity server process.
The potential impact of this flaw is significant. Exploitation could lead to unauthorized access to sensitive TeamCity data, configurations, and credentials. Furthermore, attackers might alter the server state and compromise build artifacts and downstream CI/CD pipelines. JetBrains has confirmed that all versions of TeamCity On-Premises are affected, but there is no evidence of the vulnerability being exploited in the wild. Mitigations have already been applied to TeamCity Cloud instances.
To address this issue, JetBrains has introduced a fix in versions 2025.11.7 and 2026.1.3. Additionally, a security patch plugin has been made available for versions 2017.1 and later, allowing customers unable to upgrade to secure their environments. JetBrains advises users to immediately download and install the latest version or the security patch plugin to protect their systems.
In addition to applying updates, JetBrains recommends several security practices. These include limiting access to internet-facing TeamCity servers, running servers with minimal required operating system privileges, and using VPN connections or other protective measures to prevent unauthorized access. Moreover, TeamCity servers should operate on dedicated hosts separate from build agents to enhance security.