TeamCity Security Patch Addresses Critical Code Execution Vulnerability

Post Views: 2

Critical Code Execution Vulnerability Patched in TeamCity

Vulnerability Details

JetBrains recently released updates to address a high-severity flaw in TeamCity On-Premises that allows unauthorized access and remote code execution. The vulnerability, designated CVE-2026-63077 with a CVSS score of 9.8, can be exploited through HTTP/S protocols to bypass authentication mechanisms. This enables an attacker to execute arbitrary commands on the operating system with the privileges of the TeamCity server process.

Impact

The flaw impacts all versions of TeamCity On-Premises. Exploitation could lead to unauthorized access to sensitive data, configuration files, and credentials, as well as manipulation of server states. Attackers might also compromise build artifacts and disrupt downstream continuous integration/continuous delivery (CI/CD) pipelines.

Patches and Mitigations

JetBrains confirmed that no evidence of active exploitation in the wild has been detected. Patches are available in versions 2025.11.7 and 2026.1.3. Additionally, a security patch plugin was released for users operating on older versions starting from 2017.1. This allows organizations unable to upgrade immediately to mitigate the risk.

Best Practices

JetBrains emphasized best practices for securing TeamCity environments, including restricting internet access to servers, enforcing minimal privilege principles for operating system accounts, and deploying virtual private networks (VPNs) or other protective measures. The company also advised isolating TeamCity servers on dedicated hardware separate from build agents to reduce attack surface.

The advisory highlights the importance of timely application of updates and proactive security configurations to prevent potential exploitation of the flaw.