TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution

TL;DR

JetBrains patched a critical TeamCity RCE tracked as CVE-2026-63077. The flaw scores a CVSS of 9.8 and affects all TeamCity On-Premises versions. An unauthenticated attacker with HTTP(S) access can run operating system commands on the server.

Why it matters

TeamCity sits at the center of many build and deployment pipelines. Therefore a server takeover can expose source code, stored credentials, and secrets. Attackers could also tamper with build artifacts and push malicious code downstream.

The bug needs no login and no user interaction. As a result, any internet-facing server becomes an easy target. JetBrains rated this TeamCity RCE at CVSS 9.8, near the top of the scale.

How the attack works

The weakness lives in the agent polling protocol. Build agents normally use this channel to request jobs from the server. An attacker instead sends a crafted request to that same endpoint.

The NVD traced the root cause to unsafe deserialization of untrusted data. Consequently, the server processes attacker-controlled objects and skips authentication. The attacker then runs commands with the privileges of the TeamCity process. No credentials or valid session are required.

Affected versions

All TeamCity On-Premises releases before the fix are affected. JetBrains shipped patches in versions 2025.11.7 and 2026.1.3. TeamCity Cloud already received the fix, so cloud customers need no action.

Antoni Tremblay reported the issue privately on July 10, 2026. At publication, JetBrains found no evidence of active exploitation. No public proof-of-concept has been confirmed either.

Patch and mitigation

Update now to close this TeamCity RCE if you run TeamCity On-Premises. You can download the patched build or use the in-product automatic update. See the full JetBrains advisory for details.

If you cannot upgrade

• Install the official security patch plugin, available for TeamCity 2017.1 and newer.
• Restrict network access to the server and its agent polling port to trusted ranges.
• Place internet-facing servers behind a VPN or an extra access layer.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.