Get fresh insights, pro tips, and thought starters–only the best of posts for you.
TeamCity RCE (CVE-2026-63077) is a critical authentication bypass vulnerability affecting all TeamCity On-Premises versions. An unauthenticated attacker with HTTP(S) access could exploit the TeamCity agent polling protocol to bypass authentication and execute arbitrary operating system commands with the privileges of the TeamCity server process.
Patched releases and a security patch plugin are available for supported older versions. JetBrains applied the necessary protections to TeamCity Cloud, so customers do not need to take any action, and JetBrains had not publicly confirmed active exploitation when it published the advisory.
Because TeamCity servers often manage source code, build pipelines, deployment workflows, and sensitive automation assets, a successful compromise could extend beyond the server itself. Organizations should prioritize remediation and review the security of their CI/CD infrastructure.
Not every remote code execution vulnerability targets infrastructure that sits at the center of software delivery. TeamCity is widely used to automate builds, testing, and deployments, making it a high-value enterprise asset.
A compromised TeamCity server may have access to:
The vulnerability itself does not guarantee that these assets will be accessed or modified. However, the privileged role of CI/CD infrastructure means organizations should evaluate potential downstream exposure if a server is successfully compromised. JetBrains notes that successful exploitation could expose TeamCity data, configurations, and stored credentials, or compromise build artifacts and CI/CD pipelines, depending on the privileges granted to the server process.
TeamCity CVE-2026-63077 is a vulnerability that affects all TeamCity On-Premises versions.
According to JetBrains, an attacker with HTTP(S) access to a vulnerable TeamCity server can bypass authentication through the TeamCity agent polling protocol without needing valid credentials. Successful exploitation allows arbitrary operating system command execution with the privileges assigned to the TeamCity server process.
The overall impact likely depends on how the server is configured. Systems running with elevated privileges or broad access to development resources may present greater operational risk than tightly restricted deployments.
| Component | Details |
|---|---|
| Affected product | TeamCity On-Premises |
| CVE | CVE-2026-63077 |
| Vulnerability type | Authentication bypass leading to unauthenticated remote code execution (CWE-502: Deserialization of Untrusted Data) |
| Authentication required | No |
| Fixed versions | 2025.11.7 and 2026.1.3 |
| Alternative mitigation | Security patch plugin for TeamCity 2017.1 and later |
| TeamCity Cloud | No customer action required |
| Exploitation status | JetBrains reported no known active exploitation when the advisory was published |
Applying the vendor fix should be the highest priority.
JetBrains recommends upgrading to TeamCity 2025.11.7 or 2026.1.3. Organizations that cannot immediately upgrade can deploy the security patch plugin available for TeamCity 2017.1 and newer while planning a full version update.
Alongside patching, security teams should review whether:
General CI/CD security hygiene worth considering, though not specifically recommended by JetBrains or reporters for this CVE:
Vendor remediation remains the primary response for TeamCity RCE, but endpoint management and visibility can help reduce broader enterprise risk around developer and administrator devices.
| Capability | How it supports enterprise response |
|---|---|
| Endpoint compliance and security | Enforce security and compliance policies on managed developer and administrator endpoints. |
| OS and application patch management | Deploy operating system and supported application updates to managed devices. TeamCity application updates and the security patch plugin must still be applied directly following JetBrains’ guidance. |
| Endpoint hardening | Apply security configurations and endpoint hardening policies to managed endpoints. |
| Access control | Restrict access to sensitive enterprise resources using managed, compliant devices. |
| Endpoint investigation | Review security incidents, endpoint posture, and suspicious activity on managed Windows and macOS endpoints alongside other security tools. |
| Remote response | Perform supported remote response actions on managed Windows and macOS endpoints during investigations. |
These capabilities complement vendor remediation and enterprise incident response but do not replace TeamCity-specific patching, server configuration reviews, or application-level security controls.
Cybersecurity frameworks explained, plus how UEM strengthens organizational security posture against network penetration risks.
DOWNLOADA critical authentication bypass vulnerability in TeamCity On-Premises. It lets an unauthenticated attacker with HTTP(S) access run OS commands via the agent polling protocol.
No. JetBrains says Cloud customers don’t need to act, as protections are already applied.
Deploy JetBrains’ security patch plugin (TeamCity 2017.1+), then schedule a full upgrade as soon as possible.
Treat CI/CD infrastructure as privileged infrastructure, not an ordinary application server, TeamCity RCE is a reminder why. JetBrains says it isn’t aware of active exploitation yet, but unauthenticated RCE flaws still warrant immediate action.
JetBrains recommends upgrading to 2025.11.7 or 2026.1.3 (or applying the security patch plugin for older versions) and limiting network exposure to trusted networks or VPN access. Reviewing server privileges and strengthening visibility across admin endpoints are also worth considering, though these are general best practices rather than specific JetBrains guidance.
Start your free trial to strengthen enterprise endpoint security and visibility.
SIGN UP NOW
