JetBrains Patches Critical Unauthenticated RCE in TeamCity On-Premises, Its Third Distinct Vulnerability Batch This Summer
JetBrains fixed CVE-2026-63077, a 9.8-severity flaw letting unauthenticated attackers run OS commands on TeamCity servers via the agent polling protocol.
Overview
JetBrains has patched a critical, unauthenticated remote-code-execution vulnerability in TeamCity On-Premises, tracked as CVE-2026-63077 and rated 9.8 out of 10 on the CVSS 3.1 scale, according to The Hacker News and the National Vulnerability Database. The flaw affects every version of TeamCity On-Premises and is fixed in versions 2025.11.7 and 2026.1.3, according to JetBrains.
What We Know
The vulnerability allows “an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands” with the privileges of the TeamCity server process, according to JetBrains and corroborated by Help Net Security. The NVD’s official record describes the issue this way: “In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol,” according to the National Vulnerability Database, which lists the CVSS vector as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
“The flaw allows unauthenticated remote code execution via the agent polling protocol to sidestep authentication checks and achieve command execution,” The Hacker News reported. “Depending on the privileges granted to the TeamCity server process, a successful compromise can lead to the exposure of TeamCity data, configurations, and stored credentials, or modification of server state.”
JetBrains credited security researcher Antoni Tremblay with privately reporting the flaw on July 10, 2026, according to JetBrains, The Hacker News, and GBHackers. The advisory was published on July 27, 2026, according to GBHackers and the National Vulnerability Database.
TeamCity Cloud instances have already been updated and require no customer action, according to The Hacker News. For on-premises deployments, JetBrains is urging an upgrade to 2025.11.7 or 2026.1.3, and has also released a standalone security patch plugin for TeamCity 2017.1 and later for administrators who cannot immediately upgrade, according to JetBrains. “The security patch plugin will address only the vulnerability described above (CVE-2026-63077),” JetBrains cautioned. “We always recommend upgrading your server to the latest version to benefit from many other security updates,” the company said, as reported by The Hacker News.
JetBrains also recommended that customers requiring an internet-facing TeamCity server consider requiring VPN connections or adding an extra layer of security. “Even exposing the TeamCity login screen or REST API can provide attackers with potential entry points to exploit newly disclosed vulnerabilities,” the company added, according to The Hacker News.
As of publication, there is no evidence that CVE-2026-63077 has been exploited in the wild, according to JetBrains and The Hacker News.
Third Disclosure This Summer
This is the third distinct batch of significant JetBrains security patches disclosed since early July. As The Machine Herald previously reported, JetBrains fixed critical authentication-bypass and account-takeover flaws in its Hub identity component on July 6, alongside separate code-execution bugs in IntelliJ IDEA, GoLand, and TeamCity that the company said it found through internal AI-assisted testing. On July 18, The Machine Herald reported a separate set of flaws — CVE-2026-59792 through CVE-2026-59796 — spanning IntelliJ IDEA, TeamCity, and YouTrack, credited to external researchers.
CVE-2026-63077 is an entirely separate CVE identifier from either of those earlier batches, again credited to an external researcher rather than internal testing. Because TeamCity sits at the center of many organizations’ build and deployment pipelines, an unauthenticated path to server-level command execution is particularly consequential: a compromised build server can be used to tamper with build artifacts or poison software delivered downstream to end users.
What We Don’t Know
JetBrains has not disclosed how many TeamCity On-Premises instances remain unpatched, nor released technical detail beyond the high-level mechanism description, likely to limit the risk of exploitation before administrators can update. It is also not yet known whether the vulnerability will be added to CISA’s Known Exploited Vulnerabilities catalog, which typically requires evidence of active exploitation.