Critical TeamCity Flaw CVE-2026-63077 Allows Unauthenticated RCE

JetBrains has disclosed a critical vulnerability in on-premise versions of TeamCity, tracked as CVE-2026-63077 with a CVSS score of 9.8. The flaw allows an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.

The vulnerability affects all TeamCity On-Premises versions and has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already been updated. JetBrains credited Antoni Tremblay with discovering and reporting the flaw on July 10, 2026.

Exploitation occurs via the agent polling protocol, enabling unauthenticated remote code execution. Depending on the privileges of the TeamCity server process, a successful compromise could lead to exposure of TeamCity data, configurations, stored credentials, or modification of server state. There is no evidence of active exploitation in the wild.

JetBrains has also released a security patch plugin for versions 2017.1+ for customers unable to apply the full update. The plugin addresses only CVE-2026-63077. JetBrains recommends upgrading to the latest version for comprehensive security updates. As best practices, customers should consider requiring VPN connections or implementing additional security layers to prevent unauthorized access to internet-facing TeamCity servers.