Security Intelligence
Loading table of contents...
At a glance: JetBrains has released security updates for a critical vulnerability affecting self-hosted TeamCity servers. The vulnerability allows an unauthenticated threat actor to execute commands on vulnerable systems and could expose credentials, source code, build artifacts, and software deployment pipelines. Because TeamCity often serves as a central component of software development and deployment environments, successful exploitation could provide access to connected systems and business-critical infrastructure. Organizations running TeamCity can apply the available updates or install JetBrains' security patch plugin. JetBrains reported no evidence of active exploitation when the vulnerability was disclosed.
Threat summary
On July 27, 2026, JetBrains disclosed a critical authentication bypass vulnerability affecting self-hosted TeamCity servers. All TeamCity On-Premises versions are affected. TeamCity Cloud environments are not affected because JetBrains applied mitigations before public disclosure. Alongside disclosure, JetBrains released fixes in TeamCity versions 2025.11.7 and 2026.1.3, as well as a security patch plugin for supported legacy versions.
TeamCity is a continuous integration and continuous delivery (CI/CD) platform used to automate software building, testing, and deployment workflows. The platform commonly integrates with source code repositories, cloud services, deployment tools, and credential stores, making it a central component of many software development environments.
TeamCity uses build agents to perform compilation, testing, packaging, and deployment tasks. These agents regularly communicate with the TeamCity server to receive work and report results. CVE-2026-63077 affects this agent communication mechanism, known as the agent polling protocol. By sending specially crafted requests that appear to originate from a trusted build agent, an unauthenticated threat actor can bypass authentication checks and execute arbitrary operating system commands using the privileges of the TeamCity server process.
The vulnerability is remotely exploitable and requires only Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) access to a vulnerable TeamCity server. It has a CVSS score of 9.8 and is classified as critical. The attack complexity is low, no credentials are required, and no user interaction is required. Internet-accessible TeamCity deployments face the highest risk because they can be reached directly by external threat actors.
Successful exploitation can expose TeamCity configuration data, stored credentials, source code, and build artifacts. It can also enable modification of build and deployment pipelines. In the most severe scenario, a threat actor could gain control of software delivery workflows and use trusted development infrastructure to distribute unauthorized code or gain access to connected production environments.
Analysis
CI/CD platforms are attractive targets because they often contain source code, deployment credentials, application secrets, and connections to production systems. Compromise of these platforms can affect both internal infrastructure and software released to customers. Because TeamCity sits at the center of the software development lifecycle, the impact of CVE-2026-63077 can extend well beyond the affected server.
TeamCity vulnerabilities have previously attracted attention from ransomware operators and state-sponsored threat actors seeking access to enterprise environments. While JetBrains reported no evidence of active exploitation when the advisory was published, the combination of unauthenticated access, low attack complexity, and remote code execution makes remediation a high priority for affected organizations.
Reduce exposure by upgrading TeamCity deployments to versions 2025.11.7 or 2026.1.3, or by applying JetBrains' security patch plugin for TeamCity 2017.1 and later. These updates address CVE-2026-63077.
Consider limiting TeamCity access to trusted networks, placing internet-facing deployments behind a virtual private network (VPN) or equivalent access controls, reviewing privileged credentials stored within TeamCity, and validating recent build and deployment activity for unauthorized changes.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
