JetBrains has fixed a critical vulnerability (CVE-2026-63077) affecting TeamCity On-Premises and is urging admins to upgrade self-hosted servers as soon as possible.
“For those who are unable to do so, we have released a security patch plugin,” noted Daniel Gallo, Solutions Engineering Lead at JetBrains.
TeamCity as a possible target
JetBrains TeamCity is a widely used continuous integration and continuous delivery (CI/CD) server solution.
It’s available as a JetBrains-hosted option (TeamCity Cloud) or can be self-hosted and administered by customers (TeamCity On-Premises), either on their own hardware or in a private or public cloud.
State-sponsored hacking groups and ransomware affiliates have been known to leverage vulnerabilities in unpatched TeamCity On-Premises servers in the past.
About CVE-2026-63077
Discovered and privately disclosed earlier this monht by security researcher Antoni Tremblay, CVE-2026-63077 is exploitable via the TeamCity agent polling protocol and may allow attackers to bypass authentication checks and execute OS commands with the privileges of the TeamCity server process.
“Depending on the privileges granted to the TeamCity server process, a successful attack could expose TeamCity data, configurations, and stored credentials, modify server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines,” Gallo explained.
JetBrains has already implemented the fix for TeamCity Cloud deployments, and is now advising customers to do the same on their self-hosted instances, as CVE-2026-63077 affects all TeamCity On-Premises versions.
The company said it checked TeamCity Cloud environments for signs of exploitation attempts and found none.
“At the time of publishing this advisory, we are not aware of any active exploitation of this vulnerability,” they added.
What to do?
TeamCity On-Premises customers should upgrade to version 2025.11.7 or 2026.1.3, or implement the security patch plugin if they still run v2017.1+.
Those running TeamCity v2017.1 to v2018.1 must restart the server after installing the patch, but starting from TeamCity v2018.2 admins can enable the plugin without that step.
To mitigate the risk of exploitation through this and similar vulnerabilities, JetBrains advises limiting network access to TeamCity servers to trusted networks (if possible), or limiting access to internet-facing TeamCity servers by requiring VPN connections or implementing an additional security layer.
“Even exposing the TeamCity login screen or REST API can provide attackers with potential entry points to exploit newly disclosed vulnerabilities,” the company noted.
“We also recommend running the TeamCity server with the minimum operating system privileges required for normal operation.”