JetBrains is urging administrators to update TeamCity On-Premises after correcting a critical unauthenticated remote code execution vulnerability. Tracked as CVE-2026-63077, the flaw affects all versions of the self-hosted continuous integration and continuous delivery platform.
The vulnerability is located in the protocol TeamCity uses when build agents poll the server. A remote attacker may be able to bypass authentication checks and execute operating system commands with the privileges assigned to the TeamCity server process. The practical consequences depend on how the server is configured, but the potential exposure reaches far beyond the TeamCity application itself.
Why build systems are high-value targets
A compromised CI/CD server can contain source code, deployment credentials, cloud tokens, signing material and configuration secrets. It may also have permission to create or modify software artifacts that are later distributed to production environments or customers.
This means an intrusion could become a software supply-chain incident. An attacker might alter build instructions, replace dependencies, steal secrets or insert malicious code into otherwise legitimate releases. Previous campaigns have shown that both state-backed groups and ransomware operators actively search for exposed and outdated development infrastructure.
Required remediation
JetBrains recommends upgrading TeamCity On-Premises to version 2025.11.7 or 2026.1.3. Organizations unable to complete a full upgrade can deploy the company's security patch plugin on supported installations beginning with version 2017.1. Some older deployments must be restarted after the plugin is installed.
- Restrict TeamCity access to trusted networks or require a VPN.
- Run the server process with the minimum operating system privileges.
- Review administrative actions, build changes and agent registrations.
- Rotate sensitive tokens if an exposed server may have been compromised.
- Validate recent build artifacts against known-good source and pipeline definitions.
JetBrains said TeamCity Cloud was patched by the company and that it found no evidence of exploitation attempts in those hosted environments. It was also unaware of active exploitation when the advisory was published.
Expert view
I believe build platforms deserve the same emergency response priority as domain controllers and internet-facing identity systems. Patching is essential, but teams should also investigate whether the server was reachable before the fix. A clean vulnerability scan after upgrading cannot prove that secrets or artifacts were not modified earlier. Organizations should combine remediation with log review, credential rotation and independent verification of important releases.