JetBrains Fixes Critical TeamCity RCE Flaw CVE-2026-63077

Originally published on CyberNetSec.

Executive Summary

JetBrains has released an urgent security update to address a critical unauthenticated remote code execution (RCE) vulnerability in its TeamCity On-Premises CI/CD platform. The vulnerability, tracked as CVE-2026-63077, has a CVSS score of 9.8 and affects all versions of the self-hosted product. An attacker with HTTP(S) access to a vulnerable server can exploit a flaw in the agent polling protocol to completely bypass authentication and execute arbitrary commands with the permissions of the TeamCity server process. This poses a catastrophic risk to software development pipelines, potentially allowing attackers to steal source code, inject malicious code into build artifacts, and launch widespread supply chain attacks. JetBrains has released patched versions and a security plugin and strongly advises all on-premises customers to update immediately.

---

Vulnerability Details

The vulnerability exists in the way TeamCity servers handle requests from build agents. The flaw is located in the agent polling protocol endpoint. By sending a specially crafted request to this endpoint, a remote, unauthenticated attacker can circumvent all security checks. This allows the attacker to execute arbitrary operating system commands on the TeamCity server. The commands run with the same privileges as the TeamCity server process, which is often a highly privileged account.

A successful exploit gives an attacker full control over the TeamCity server, which is a 'crown jewel' asset in any software development organization. The potential for follow-on supply chain attacks is extremely high.

---

Affected Systems

• Product: JetBrains TeamCity On-Premises
• Affected Versions: All versions prior to the patched releases.

Patched Versions:

• 2025.11.7
• 2026.1.3

For users unable to upgrade immediately, a security patch plugin is available for TeamCity versions 2017.1 and newer. TeamCity Cloud instances have already been patched by JetBrains and are not vulnerable.

---

Exploitation Status

At the time of disclosure on July 27, 2026, JetBrains was not aware of any public exploits or in-the-wild exploitation. However, given the critical nature of the flaw (unauthenticated RCE with a 9.8 CVSS score) and the high value of TeamCity servers as targets, it is highly probable that threat actors will rapidly develop and deploy exploits. Organizations should assume exploitation is imminent.

---

Impact Assessment

A compromise of a TeamCity server is a worst-case scenario for a development organization. The impact includes:

• Source Code Theft: Attackers can access all source code repositories connected to TeamCity.
• Credential Theft: The server contains secrets, API keys, and credentials used in build processes, which can be stolen to pivot to other systems (cloud environments, package registries, etc.).
• Software Supply Chain Compromise: This is the most severe risk. Attackers can modify build scripts to inject malware, backdoors, or credential stealers into the software being built. This malicious code would then be signed and distributed to the organization's customers, leading to a massive supply chain attack similar to the SolarWinds incident.
• Lateral Movement: The compromised server can be used as a powerful pivot point to attack the internal development network.

---

IOCs — Directly from Articles

No specific Indicators of Compromise were mentioned in the source articles.

---

Cyber Observables — Hunting Hints

Security teams should hunt for the following patterns to identify potential exploitation:

• URL Patterns: Monitor web server and reverse proxy logs for unusual requests to TeamCity agent polling endpoints, such as /app/rest/agents/ or similar paths, especially from IP addresses that are not known build agents.
• Process Monitoring: On the TeamCity server, monitor for the server process (e.g., java.exe) spawning unexpected child processes like cmd.exe, powershell.exe, /bin/bash, curl, or wget. This is a strong indicator of RCE.
• Network Connections: Look for unexpected outbound network connections from the TeamCity server to unknown IP addresses. This could be the attacker establishing a reverse shell or exfiltrating data.
• File System Changes: Monitor for the creation of unexpected files (scripts, binaries) in directories writable by the TeamCity server process.

---

Detection & Response

1. Log Analysis: Ingest TeamCity and web server logs into a SIEM. Create alerts for the cyber observables listed above, particularly anomalous process creation originating from the TeamCity service.
2. Network Intrusion Detection: Deploy NIDS signatures that can detect exploit attempts against CVE-2026-63077. Monitor all traffic to the TeamCity server's web interface.
3. File Integrity Monitoring (FIM): Use FIM on the TeamCity server to alert on changes to critical build configuration files (.xml) or the creation of suspicious executable files.

---

Mitigation

1. Upgrade Immediately: The primary and most effective mitigation is to upgrade to a patched version (2025.11.7 or 2026.1.3). This is an urgent requirement. This aligns with M1051 - Update Software.
2. Apply Security Plugin: If an immediate upgrade is impossible, apply the security patch plugin provided by JetBrains. This is a temporary measure until a full upgrade can be performed.
3. Restrict Access: Ensure the TeamCity server is not exposed to the public internet. Access should be restricted to trusted IP addresses (like corporate VPNs and known build agent locations). This is a form of M1035 - Limit Access to Resource Over Network.
4. Web Application Firewall (WAF): Place a WAF in front of the TeamCity server to provide an additional layer of defense and to apply virtual patching rules once they become available.