A 9.8-severity flaw in TeamCity On-Premises lets anyone with network access run commands on your build server — no credentials, no phishing, just a crafted request.
JetBrains shipped a fix on July 27 for a bug that lets an attacker who has never logged in — never even seen a username field — run arbitrary commands on your build server. CVE-2026-63077 carries a CVSS score of 9.8, and it hits every version of TeamCity On-Premises still running, from the ancient 2017.1 branch up to the day before the patch. If your company runs its own CI/CD pipeline instead of TeamCity Cloud, this is the one to stop and fix before you read the rest of this.
How an attacker walks in without a password
TeamCity build agents check in with the central server constantly — that's the agent polling protocol, the plumbing that lets a fleet of build machines ask "anything for me to run?" every few seconds. CVE-2026-63077 is a deserialization bug in that channel: an attacker with plain HTTP(S) access to the server can send a crafted request that the server deserializes as if it came from a trusted agent, skipping authentication entirely. From there, the attacker isn't just reading data — they're executing operating system commands with the same privileges as the TeamCity server process itself.
No known exploitation yet — don't read that as 'not urgent'
JetBrains says it has no reports of active exploitation as of the disclosure. That's genuinely good news, but it's a snapshot, not a guarantee — the gap between a patch going public and someone reverse-engineering it into a working exploit has been shrinking for years, and deserialization bugs are some of the easiest to weaponize once the diff between the vulnerable and patched code is public. This is the same pattern that played out with Gitea's own git-hook RCE last month and the wave of exploited SharePoint RCEs this year: developer and collaboration tooling is having a rough 2026, and the common thread is always the same — these systems trust more than they should, and attackers have noticed. Check Point's own SmartConsole had an authentication bypass discovered before a patch even existed; TeamCity at least gives you a head start.
What's affected vs. what's fixed
TeamCity On-Premises 2017.1 – 2025.11.6
Status
Vulnerable — apply the security patch plugin or upgrade
TeamCity On-Premises 2025.11.7
Status
Patched
TeamCity On-Premises 2026.1.3
Status
Patched
TeamCity Cloud
Status
Not affected — no action needed
Status
TeamCity On-Premises 2017.1 – 2025.11.6
Vulnerable — apply the security patch plugin or upgrade
TeamCity On-Premises 2025.11.7
Patched
TeamCity On-Premises 2026.1.3
Patched
TeamCity Cloud
Not affected — no action needed
CVE-2026-63077 lets an attacker skip authentication entirely and run operating system commands directly on a TeamCity server. · Unsplash
1
Check your TeamCity On-Premises version now — it's shown in Administration > Server Health or the footer of any admin page.
2
Upgrade to 2025.11.7 or 2026.1.3 if you can schedule the downtime.
3
Can't upgrade yet? Install JetBrains' security patch plugin — available for 2017.1 and later, with automatic notifications built in from 2024.03 onward.
4
Rotate credentials stored in TeamCity's credential store as a precaution — JetBrains' advisory doesn't rule out undetected prior access.
5
Check server access logs for unusual agent-registration activity around and after July 10, 2026, when the bug was first reported.
Quick answers
Is TeamCity Cloud affected by CVE-2026-63077?
No. JetBrains says only the self-hosted On-Premises product is vulnerable; Cloud customers don't need to do anything.
Has CVE-2026-63077 been exploited in the wild?
Not as of JetBrains' July 27, 2026 disclosure — the company says it has no reports of active exploitation. That can change quickly once a patch reveals what was broken, so treat the window until you patch as the risk period.
What CVSS score does CVE-2026-63077 carry?
9.8 out of 10 — critical severity, unauthenticated, no user interaction required.
Do I need to be logged in for an attacker to exploit this?
No — that's the entire point of the bug. Anyone with HTTP(S) network access to your TeamCity server can exploit it without any credentials at all.
My honest take: a build server should never be the softest target in the building, and yet CI/CD tools keep landing on this list — Gitea's hook bug last month, now this. If your TeamCity instance is reachable from the open internet rather than sitting behind a VPN or an allow-list, that's the bigger conversation worth having this week, patch or no patch.
