JetBrains Patches Critical TeamCity Flaw That Let Attackers Run Commands Without Logging In
CVE-2026-63077 carries a 9.8 severity score and affects every on-premises version of the build server. Cloud customers were patched automatically.
Key points
- JetBrains has patched a critical flaw in TeamCity On-Premises tracked as CVE-2026-63077, scoring 9.8 out of 10 on the standard severity scale.
- The bug lets an unauthenticated attacker run operating system commands on the server with no credentials required.
- Fixed builds are TeamCity 2025.11.7 and 2026.1.3, released this week.
- JetBrains says all TeamCity Cloud instances were patched automatically before the disclosure.
- Every on-premises version prior to those two builds is affected; self-hosted customers must update manually.
JetBrains is telling every self-hosted TeamCity customer to update now.
TeamCity is a build server: software that development teams use to compile and ship their code. Whoever controls it can push tampered code into the products a company ships. That's why bugs in this class of tool get treated as emergencies.
The company disclosed the flaw and assigned it CVE-2026-63077. It scores 9.8 on the CVSS scale, which runs from 0 to 10. Anything above 9 is treated as critical.
What does the flaw actually let attackers do?
It lets an outsider run commands on the server without logging in. JetBrains describes the issue as one that can result in arbitrary code execution, meaning an attacker can run whatever program they choose on the target machine.
Because no authentication is required, anyone who can reach the TeamCity login page over the network can attempt exploitation directly. Servers exposed to the public internet face the highest risk. Internal servers aren't safe either: anyone already inside the network can try the same thing.
JetBrains hasn't published technical detail on the underlying weakness, and no public exploit code had been reported as of publication. That gap tends to close fast with bugs at this severity level.
Which versions are fixed?
Two builds contain the fix. Everything before them is vulnerable.
| Product | Status | Version |
|---|---|---|
| TeamCity On-Premises (2025.11 line) | Fixed | 2025.11.7 |
| TeamCity On-Premises (2026.1 line) | Fixed | 2026.1.3 |
| TeamCity On-Premises (all earlier) | Vulnerable | Update required |
| TeamCity Cloud | Fixed by JetBrains | No action needed |
Cloud customers don't need to act. JetBrains patched those instances before publishing the advisory. Everyone else has to install the update themselves.
What should administrators do right now?
Update to 2025.11.7 or 2026.1.3, whichever matches your release line, before exposing the server to any untrusted network. That's the only supported fix.
If an immediate update isn't possible, restrict access to the TeamCity web interface: put it behind a corporate VPN or an allow-list of known IP addresses. That reduces who can attempt exploitation while you schedule the upgrade, but it doesn't remove the vulnerability.
After patching, audit the server's recent activity. Check authentication logs and any build configurations added or changed in recent weeks. TeamCity flaws have been abused before to plant backdoors inside software builds, so a clean patch isn't the same as a clean system. We covered a similarly urgent unauthenticated-takeover scenario in July with two WordPress flaws criminals were actively exploiting, and the lesson there applied here too: patching late still beats not patching, but the window closes faster than most teams expect.
Customers with a support contract can raise a ticket with JetBrains for guidance on log review.
The detail JetBrains hasn't yet released is the technical root cause. Watch for that: when it drops, exploit attempts typically follow within hours.
