By ByteBot
JetBrains disclosed CVE-2026-63077 on July 27 — a CVSS 9.8 unauthenticated remote code execution flaw affecting every version of TeamCity On-Premises. An attacker with nothing but HTTP access to your server can run arbitrary OS commands as the TeamCity process. No login. No credentials. No session token. Just network access and a crafted request. If your TeamCity instance is reachable from the internet — or from anywhere inside your network an attacker has already reached — it is exposed right now.
How the Exploit Works
The vulnerability lives in TeamCity’s agent polling protocol — the HTTP(S) endpoint build agents use to check in with the server and pull job assignments. The root cause is insecure deserialization of untrusted data (CWE-502): the server processes attacker-supplied objects coming through that endpoint without any authentication checks.
The practical result: an attacker sends a crafted payload to the same port your build agents poll, and the server executes their commands with the privileges of the TeamCity server process. From there they can harvest every credential stored in TeamCity — VCS tokens, cloud deploy keys, Docker registry passwords, signing certificates — and tamper with build steps or poison build artifacts before they ship.
TeamCity Cloud instances have already been patched automatically. On-Premises installations need to act now.
What to Do Right Now
JetBrains has released fixed versions and a standalone security patch plugin. Per the official JetBrains advisory, you have two routes:
Upgrade (recommended): If you are on the 2026.x branch, update to 2026.1.3. If you are on 2025.11.x, update to 2025.11.7. This is the only option that bundles additional security fixes alongside the CVE-2026-63077 patch.
Security patch plugin (if you cannot upgrade today): JetBrains released a standalone plugin that fixes this specific vulnerability on TeamCity 2017.1 and later. If you are on TeamCity 2024.03+, the plugin may already be downloaded — check Administration > Updates under “Available security updates.” For older versions, download and install it manually. No server restart is required on TeamCity 2018.2 and later; 2017.1 and 2018.1 installations need a restart. The plugin only addresses CVE-2026-63077, so treat it as a bridge, not a permanent solution.
If you genuinely cannot upgrade or install the plugin today, restrict network access to the agent polling endpoint at the firewall level to known build agent IPs only. That reduces your exposure without eliminating it — a stopgap, not a fix.
This Has Happened Before — Twice
TeamCity has a documented track record of being targeted immediately after high-severity CVEs drop. Rapid7’s threat analysis notes that CVE-2023-42793, another unauthenticated CVSS 9.8 RCE in TeamCity, was exploited within weeks of disclosure by Russia’s SVR (APT29). CVE-2024-27198 — yet another unauthenticated 9.8 in the same product — made CISA’s Known Exploited Vulnerabilities catalog within three days of publication and was used in active ransomware campaigns.
JetBrains says there is no confirmed active exploitation of CVE-2026-63077 as of July 27. That window is narrow. The prior two CVEs in this pattern went from “no confirmed exploitation” to actively ransomwared in days. The attack surface is identical: unauthenticated, network-accessible, CVSS 9.8. Threat actors who tracked the 2024 campaigns have all the templates they need.
Why CI/CD Servers Are Targeted
Your CI/CD server is the most credential-dense system in your infrastructure. It holds the tokens that let it push to GitHub, assume AWS roles, deploy to Kubernetes, sign packages, and publish to registries. A TeamCity compromise does not just expose source code — it gives an attacker the keys to everything that code touches downstream.
The March 2025 compromise of the tj-actions/changed-files GitHub Action illustrated exactly how CI/CD access cascades: one poisoned build step exposed secrets from over 23,000 repositories. Owning a TeamCity server outright — with RCE and full credential access — puts an attacker in a position to cause that kind of damage across your entire supply chain and point it at your customers.
Around 5,700 companies run TeamCity On-Premises globally. If your organization is among them, patch today. The official advisory has the download links.
