Affected Systems

JetBrains TeamCity On-Premises, all versions prior to 2025.11.7 and 2026.1.3. TeamCity Cloud is not affected. CVE-2026-63077 allows authentication bypass via agent polling protocol over HTTPS, leading to remote code execution with server process privileges.

Exploitation Status

No evidence of active exploitation as of July 27, 2026. Vulnerability was privately disclosed on July 10, 2026. Given TeamCity's history as a target for ransomware gangs and state-backed actors, exploitation is likely imminent.

Business Impact

Critical risk to CI/CD infrastructure. Successful exploitation grants attackers OS-level command execution, enabling theft of TeamCity configurations, stored credentials, source code, and build artifacts. Attackers can compromise entire software supply chains by poisoning build pipelines. Only requires HTTPS access to the TeamCity server—no authentication needed. Organizations with internet-facing TeamCity instances are at highest risk.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade TeamCity On-Premises to version 2025.11.7 or 2026.1.3 immediately
  • If upgrade is not feasible, install the security patch plugin available for TeamCity 2017.1 and later (restart required for versions 2017.1 through 2018.1)
  • Restrict network access to TeamCity servers using VPN or firewall rules—do not expose login pages or REST API directly to the internet
  • Review TeamCity access logs for suspicious agent polling activity or unauthorized authentication attempts since July 10, 2026
  • Audit stored credentials, build configurations, and artifacts for signs of compromise if server was internet-accessible