Critical Vulnerability in TeamCity On-Premises
JetBrains has issued an urgent security advisory for users of its TeamCity CI/CD platform. A critical security flaw, identified as CVE-2026-63077, allows unauthenticated attackers to execute arbitrary operating system commands on the host server. With a CVSS score of 9.8, this vulnerability represents a severe threat to the integrity of software build pipelines and corporate infrastructure.
According to The Hacker News, the vulnerability affects all on-premises installations of TeamCity. While JetBrains has already patched its cloud-based instances, administrators managing self-hosted environments must take manual action to apply the necessary security updates. The ability to run commands without valid credentials means that any TeamCity server exposed to the internet or an untrusted internal network is at immediate risk of compromise.
Technical Analysis of CVE-2026-63077
The vulnerability enables RCE by bypassing authentication mechanisms that should restrict access to sensitive administrative functions. In a CI/CD context, an RCE exploit is particularly devastating. TeamCity servers typically hold high-level permissions, including access to source code repositories, cloud provider credentials, and code-signing certificates.
If an attacker gains control over a build server, they can orchestrate a Supply Chain Attack by injecting malicious code into software artifacts. Because these artifacts are produced by a trusted system, the malicious payloads may be signed and distributed to thousands of downstream customers without triggering traditional security alerts. This bypasses the security of the end-user by compromising the source of truth.
Impact on Build Pipelines and Infrastructure
Beyond the immediate threat of code injection, a compromised TeamCity instance allows for Lateral Movement within the corporate network. Attackers can use the server as a beachhead to scan internal resources, escalate privileges, and exfiltrate sensitive data. Given that CI/CD tools often have network paths to production environments for automated deployment, the blast radius of CVE-2026-63077 extends far beyond the build server itself.
How to detect CVE-2026-63077 exploit attempts
Security teams should prioritize visibility into their TeamCity environments to identify potential compromise. To effectively monitor for threats, SOC analysts should ingest web server logs into a SIEM to look for unusual patterns. Specifically, look for unexpected POST requests to administrative endpoints originating from unauthorized or external IP addresses.
Furthermore, EDR solutions should be monitored for suspicious process spawning. If the TeamCity service process (typically Java) starts executing shell commands like /bin/sh, cmd.exe, or PowerShell scripts that are not part of a defined build configuration, it is a high-fidelity IoC of exploitation. Organizations should also review their audit logs for the creation of new, unauthorized administrative accounts within the TeamCity interface, which is a common persistence tactic after initial access.
Remediation and Patch JetBrains TeamCity 2025.11.7
The most effective mitigation is to patch JetBrains TeamCity 2025.11.7 or version 2026.1.3 immediately. These versions contain the definitive fix for the authentication bypass and command injection vector. For organizations unable to update instantly, the following steps are recommended as part of a comprehensive TeamCity On-Premises RCE mitigation guide:
- Restrict Network Access: Ensure the TeamCity web interface is not accessible from the public internet. Use a VPN or Zero Trust access gateway to limit exposure to known, authenticated users.
- Audit Service Accounts: Review the permissions assigned to the TeamCity service. Follow the principle of least privilege to ensure that even if the application is compromised, the attacker’s ability to interact with the underlying OS is limited.
- Monitor Outbound Traffic: CI/CD servers should have restricted egress. Block any outbound connections to unknown IP addresses to prevent the server from establishing a C2 channel or downloading additional malware payloads.
JetBrains has confirmed that TeamCity Cloud users do not need to take any action, as those environments have been secured by the vendor. However, the prevalence of on-premises installations in high-security sectors makes this a priority for global defense teams.