CVE-2026-63077: JetBrains TeamCity Pre-Auth RCE (CVSS 9.8)

JetBrains TeamCity On-Premises disclosed pre-auth RCE CVE-2026-63077, CVSS 9.8. Attackers bypass auth over HTTP and run arbitrary commands, putting the CI/CD supply chain at risk.

Incident overview

On 27 July 2026, JetBrains published a security advisory for CVE-2026-63077, a pre-auth remote code execution flaw in the TeamCity On-Premises CI platform. CVSS v3.1 is 9.8 (Critical). An attacker with HTTP or HTTPS access to a TeamCity server needs no credentials and no user interaction. Auth checks are bypassed; arbitrary OS commands run as the TeamCity server process.

TeamCity is a widely used CI/CD build automation platform. Enterprises use it to compile, test, and deploy production code. Independent researcher Antoni Tremblay privately reported the issue on 10 July 2026 via coordinated disclosure. JetBrains said it had found no evidence of active exploitation at publication time. Prior TeamCity bugs were weaponized fast. Treat every self-hosted TeamCity instance as an emergency.

Technical details

Vulnerability facts

CVE ID CVE-2026-63077

CVSS v3.1 9.8 (Critical, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Type CWE-502: insecure deserialization (Deserialization of Untrusted Data)

Attack vector Network, unauthenticated, no user interaction

Affected component TeamCity On-Premises (all on-prem versions before the fix)

Internals

The bug sits in TeamCity's Agent Polling Protocol. Build agents use that protocol to pull work from the server. The server deserializes untrusted data while handling agent polling requests. A crafted request to that endpoint bypasses authentication and triggers arbitrary OS command execution.

On success, commands run as the TeamCity server process. Depending on the service account, an attacker can:

• Access TeamCity project data, server config, and stored credentials
• Tamper with server state and change build job configs
• Poison build artifacts and hit downstream CI/CD pipelines
• Steal source code, API keys, cloud credentials, and other secrets
• Pivot from the TeamCity server into the enterprise network

Affected versions

All TeamCity On-Premises versions before the fix. JetBrains shipped patches in:

• TeamCity 2025.11.7
• TeamCity 2026.1.3

If you cannot upgrade immediately, JetBrains also ships a security-patch plugin (TeamCity 2017.1 and later) as a temporary mitigation.

Impact

• CVSS 9.8, trivial bar: no auth, no interaction, low complexity. Prime target.
• CI/CD supply-chain core: TeamCity owns compile, test, and deploy of production code.
• Weaponization history: prior critical TeamCity bugs were quickly used by nation-state actors and ransomware groups.
• Credential concentration: TeamCity servers typically store cloud keys, code-signing certs, deploy credentials, and more.
• Artifact poisoning: own TeamCity, plant a backdoor at build time, hit every downstream consumer.

Mitigation

Option 1: Upgrade to a patched release (recommended)

Upgrade TeamCity On-Premises immediately to either:

• TeamCity 2025.11.7
• TeamCity 2026.1.3

Use a manual download or TeamCity auto-update.

Option 2: Install the security-patch plugin (if you cannot upgrade now)

JetBrains' official security-patch plugin covers TeamCity 2017.1 and later and only remediates CVE-2026-63077:

• TeamCity 2024.03 and later: enable the plugin with no restart
• TeamCity 2017.1 to 2018.1: restart the server after install
• Admins can view and install it under Administration → Updates → Available Security Updates

The plugin is not a substitute for a full upgrade. Temporary only.

Defense in depth

• Network isolation: keep TeamCity on a trusted network; no direct internet exposure
• VPN or extra access layer: internet-facing TeamCity belongs behind VPN or a reverse proxy
• Least privilege: run the TeamCity service with the minimum OS rights required
• Physical separation: put the TeamCity server and Build Agents on separate hosts
• Credential rotation: after patching, rotate all VCS credentials, cloud keys, and API tokens stored in TeamCity
• Log review: inspect TeamCity access logs for anomalous agent-polling request patterns

References

• JetBrains TeamCity security advisory: CVE-2026-63077
• SecurityWeek: Critical TeamCity code-execution flaw patched
• Cybersecurity News: JetBrains emergency-patches TeamCity
• InfoWorld: JetBrains warns of TeamCity pre-auth RCE
• Anheng Information: JetBrains TeamCity critical RCE analysis