JetBrains TeamCity Remote Code Execution Vulnerability (CVE-2026-63077)

JetBrains released a security advisory addressing a critical severity vulnerability impacting TeamCity On-Premises. Tracked as CVE-2026-63077, successful exploitation of the vulnerability may allow an unauthenticated attacker to bypass authentication checks and execute arbitrary operating system commands.

JetBrains mentioned in their advisory that they are not aware of any active exploitation of this vulnerability.

TeamCity is a general-purpose CI/CD software platform that enables customizable workflows, teamwork, and development methodologies. The tool helps in continuous integration, delivery, and deployment within the DevOps process.

Vulnerability Details

There is no authentication required for the exploitation of the vulnerability. An unauthenticated attacker may exploit the vulnerability via the TeamCity agent polling protocol. Upon successful exploitation, an attacker may bypass authentication checks and execute arbitrary commands with the privileges of the TeamCity server process.

The advisory states, “Depending on the privileges granted to the TeamCity server process, a successful attack could expose TeamCity data, configurations, and stored credentials, modify server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines.”

Affected Versions

The vulnerability affects JetBrains TeamCity prior to version(s) 2026.1.3 and 2025.11.7.

Mitigation

The vendor provides two ways to patch the vulnerability.

1. Upgrade to the JetBrains TeamCity server to 2025.11.7 or 2026.1.3.
2. Apply the security patch plugin that can be installed on TeamCity 2017.1.

To get the security patch plugin:

• Download and install it manually.
• For TeamCity 2024.03 and newer, TeamCity automatically downloads available security patch plugins and notifies administrators (if notifications are configured).

Please refer to the JetBrains Security Advisory for more information.

Qualys Detection

Qualys customers can scan their devices with QID 388160 to detect vulnerable assets.

Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.

References
https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/