Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077 ...
Found by web discovery while looking for coverage of CVE-2026-63077
JetBrains fixed critical unauthenticated RCE CVE-2026-63077 in TeamCity On-Premises; update to 2025.11.7 or 2026.1.3.
JetBrains disclosed CVE-2026-63077, a critical unauthenticated remote code execution vulnerability affecting all TeamCity On-Premises versions. An attacker with HTTP(S) access can bypass authentication checks via the TeamCity agent polling protocol and execute arbitrary operating system commands with the privileges of the server process. Fixes are available in versions 2025.11.7 and 2026.1.3, plus a security patch plugin for TeamCity 2017.1+. JetBrains states there is no evidence of active exploitation at disclosure time, and TeamCity Cloud is already mitigated.
- All TeamCity On-Premises versions affected; Cloud already mitigated with no evidence of exploitation.
- Attack path: unauthenticated access via agent polling protocol, auth bypass, arbitrary OS commands.
- Update to 2025.11.7 or 2026.1.3, or install the security patch plugin for 2017.1+.
- Successful compromise could expose stored credentials, alter server state, and corrupt CI/CD build artifacts.
- JetBrains reports no active exploitation at disclosure time.
- CVEs
- CVE-2026-63077
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-63077 | Unauthenticated Deserialization RCE in JetBrains TeamCity On-Premises | 9.8 | 94% | KEVRansomwarePoC | KEV |
From the original article
3 min read at blog.jetbrains.com
If exploited, this vulnerability may allow an unauthenticated attacker with HTTP (S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands. This vulnerability affects all TeamCity On-Premises versions. The issue has been fixed in versions 2025.
By @jetbrains · blog.jetbrains.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.