Critical JetBrains TeamCity CVE-2024-27198 Remote Code Execution Flaw Patched

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-63077, has been discovered in JetBrains TeamCity On-Premises.
• The flaw allows unauthenticated attackers with network access to execute arbitrary commands on the server.
• All versions of TeamCity On-Premises are affected, posing significant risk to CI/CD pipelines.
• Patches are available in versions 2025.11.7 and 2026.1.3, along with a security patch plugin for older versions.

JetBrains has disclosed a severe security vulnerability impacting its TeamCity On-Premises continuous integration/continuous delivery (CI/CD) server. Identified as CVE-2026-63077, this critical flaw could enable remote attackers to bypass authentication mechanisms and execute arbitrary commands on affected servers.

The vulnerability poses a substantial threat to organizations utilizing TeamCity for their software development workflows. Any TeamCity On-Premises server is susceptible if an attacker has HTTP or HTTPS network access, regardless of whether they possess valid credentials or prior access to the system.

According to JetBrains, the root cause of the issue lies within the TeamCity agent polling protocol. Exploiting this protocol allows an unauthenticated remote attacker to circumvent security checks and execute operating system commands with the same privileges as the TeamCity server process itself.

Such unauthorized access presents profound risks. A successful compromise could expose sensitive data such as stored credentials, configuration files, build artifacts, and project secrets. Furthermore, attackers could manipulate build settings, inject malicious code into software releases, or alter development pipelines, potentially leading to supply chain attacks.

JetBrains Vulnerability Details

The flaw was privately reported to JetBrains on July 10, 2026, by security researcher Antoni Tremblay, who followed the company’s coordinated disclosure process. JetBrains subsequently assigned the identifier CVE-2026-63077 to this critical vulnerability.

Remediation and Patches

JetBrains has released patches for the vulnerability in TeamCity versions 2025.11.7 and 2026.1.3. Administrators are strongly advised to upgrade their installations to one of these patched versions immediately, either by downloading them directly or utilizing the built-in automatic update feature where available.

For organizations unable to perform a full version upgrade immediately, JetBrains offers a dedicated security patch plugin. This plugin specifically addresses CVE-2026-63077 and is compatible with TeamCity versions 2017.1 and later. While the plugin provides an immediate fix, JetBrains stresses that it should be considered a temporary measure, as a full version upgrade incorporates additional important security enhancements.

TeamCity versions 2024.03 and newer can automatically download available security patch plugins and notify administrators if notifications are enabled. Security updates can be reviewed through the Administration menu under “Updates” and “Available Security Updates.”

It is important for administrators to note that TeamCity servers running versions 2017.1 through 2018.1 will require a server restart after the plugin installation. Conversely, installations of TeamCity version 2018.2 and later can enable the patch plugin without needing a server reboot.

JetBrains has confirmed that its TeamCity Cloud customers are not required to take any action. The company has already implemented necessary protections in its cloud infrastructure and has found no evidence of this particular flaw being exploited in TeamCity Cloud instances.

As of the official announcement, JetBrains stated it was unaware of any active exploitation of CVE-2026-63077 in the wild. However, the potential for unauthenticated remote code execution makes swift remediation imperative for all On-Premises deployments.

What You Should Do

• Upgrade Immediately: Update TeamCity On-Premises to versions 2025.11.7 or 2026.1.3 without delay.
• Install Security Patch Plugin: If immediate upgrade is not feasible, install the dedicated security patch plugin for CVE-2026-63077, available for versions 2017.1 and later. Remember this is a temporary solution.
• Restrict Network Access: Limit TeamCity server access to trusted internal networks only.
• Implement Access Controls: Place any internet-facing TeamCity instances behind a VPN or other robust access control layers.
• Apply Principle of Least Privilege: Ensure the TeamCity service runs with the absolute minimum necessary operating system privileges.
• Isolate Build Agents: Consider hosting TeamCity servers separately from build agents to contain the potential impact of a compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.