JetBrains Patches Critical TeamCity Flaw That Let Attackers Run Commands Without Logging In
CVE-2026-63077 carries a 9.8 severity score and affects every on-premises version of the build server. Cloud customers were fixed automatically.
Key points
- JetBrains has patched a critical flaw in TeamCity On-Premises tracked as CVE-2026-63077, scoring 9.8 out of 10 on the standard severity scale.
- The bug lets an unauthenticated attacker run operating system commands on the server, meaning no password or login is needed to take control.
- Fixed builds are TeamCity 2025.11.7 and 2026.1.3, released this week.
- JetBrains says all TeamCity Cloud instances were patched automatically before the disclosure.
- Every on-premises version prior to the two fixed builds is affected, so self-hosted customers must update manually.
JetBrains is telling every self-hosted TeamCity customer to update now.
TeamCity is a build server: software that development teams use to compile, test and ship their code. If an attacker controls it, they can push tampered code into the products a company ships to its customers. That is why bugs in this class of tool get treated so seriously.
The company disclosed the flaw this week and assigned it CVE-2026-63077, a unique identifier used to track a specific security vulnerability. It scores 9.8 on the CVSS scale, which runs from 0 to 10. Anything above 9 is treated as critical.
What does the flaw actually let attackers do?
It lets an outsider run commands on the TeamCity server without logging in first. In JetBrains' own wording, the issue can result in arbitrary code execution, which is the industry term for an attacker being able to run whatever program they choose on the target machine.
Because no authentication is required, an attacker who can reach the TeamCity login page over the network can attempt exploitation directly. Servers exposed to the public internet are the most exposed. Internal servers are still at risk from anyone already inside the network.
JetBrains has not published technical detail on the underlying weakness, and as of writing no public exploit code has been reported. That gap tends to close quickly with bugs of this severity, as first reported by The Hacker News.
Which versions are fixed?
Two builds contain the fix. Everything before them is vulnerable.
| Product | Status | Version |
|---|---|---|
| TeamCity On-Premises (2025.11 line) | Fixed | 2025.11.7 |
| TeamCity On-Premises (2026.1 line) | Fixed | 2026.1.3 |
| TeamCity On-Premises (all earlier) | Vulnerable | Update required |
| TeamCity Cloud | Fixed by JetBrains | No action needed |
Customers running the hosted Cloud edition do not need to do anything. JetBrains patched those instances before publishing the advisory. Everyone else has to install the update themselves.
What should administrators do right now?
Update to 2025.11.7 or 2026.1.3, whichever matches your release line, and do it before exposing the server to any untrusted network. That is the only supported fix.
If an immediate update is not possible, restrict who can reach the TeamCity web interface. Put it behind a corporate VPN or an allow-list of known office IP addresses. This does not remove the vulnerability. It reduces the pool of people who can try to exploit it while you schedule the upgrade.
After patching, review the server's recent activity. Look at authentication logs, new administrator accounts, and any build configurations that were changed or added in the past few weeks. TeamCity flaws have been abused in the past to plant backdoors inside software builds, so a clean patch is not the same as a clean system.
Customers with a support contract can raise a ticket with JetBrains for guidance on log review.
