JetBrains has disclosed and patched a critical unauthenticated remote code execution vulnerability in its widely used TeamCity On-Premises CI/CD server. Tracked as CVE-2026-63077 and carrying a CVSS score of 9.8, the bug affects every version of TeamCity On-Premises and lets an unauthenticated attacker with HTTP(S) access to a server run arbitrary operating-system commands.
What the flaw does
According to JetBrains' advisory, the vulnerability lives in the TeamCity agent polling protocol and lets an attacker bypass authentication checks entirely. A successful exploit runs commands with the privileges of the TeamCity server process, potentially exposing TeamCity data, configurations and stored credentials, modifying server state, and compromising the integrity of build artifacts and downstream CI/CD pipelines.
Timeline and disclosure
The vulnerability was reported privately to JetBrains on July 10 by security researcher Antoni Tremblay through the company's coordinated disclosure program. JetBrains published its advisory on July 27 alongside fixes in TeamCity 2025.11.7 and 2026.1.3, plus a dedicated security patch plugin for anyone unable to upgrade. TeamCity Cloud is unaffected and JetBrains says it has "no evidence of active exploitation" at time of disclosure.
Why CI/CD servers are prized targets
TeamCity is the second major post-authentication or pre-authentication RCE JetBrains has patched in the last few months, following an earlier high-severity flaw (CVE-2026-44413) disclosed in May. CI/CD servers are among the most valuable targets in enterprise networks because they hold credentials for source control, cloud accounts and package registries. Recent CI/CD-adjacent incidents include a public GitLab RCE proof-of-concept and Zenity's AgentForger flaw in ChatGPT agents.
What administrators should do now
JetBrains is telling every TeamCity On-Premises customer to upgrade immediately to 2025.11.7 or 2026.1.3. Environments that cannot upgrade should install the security patch plugin, which supports TeamCity 2017.1 and later. The company also reiterated longer-term best practices for internet-facing servers, including requiring VPN access, running TeamCity with minimum OS privileges and keeping the server on a host separate from build agents. See also NVIDIA's Open Secure AI Alliance for related supply-chain security moves.
Reporting based on coverage from the JetBrains security blog, Help Net Security, The Hacker News and Cybersecurity News.