Published Tuesday, July 28, 2026 at 03:55 PM PT
BLUF: JetBrains has released a patch for CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in TeamCity On-Premises that permits complete server takeover. Organizations running unpatched deployments face immediate risk of infrastructure compromise.
DETAILS:
- Vulnerability: Unauthenticated RCE in JetBrains TeamCity On-Premises; no authentication bypass required
- Severity: Critical; results in full server compromise and code execution
- Attack surface: Accessible to any network-adjacent threat actor; exploitation is trivial once vulnerability is known
- Patch status: Patches released by JetBrains; specific affected versions and patch version numbers are not detailed in available sources
- Deployment scope: Confirmed for On-Premises deployments; cloud-hosted TeamCity status unclear from available material
IMPACT: Any organization operating vulnerable TeamCity On-Premises instances is exposed to unauthenticated attackers capable of executing arbitrary code with server privileges. This permits complete infrastructure compromise including credential harvesting, CI/CD pipeline poisoning (with downstream supply-chain risk), lateral movement into connected systems, and data exfiltration.
RECOMMENDED ACTIONS:
- Immediately: Audit all TeamCity deployments to identify On-Premises instances and current version running on each
- Urgent: Consult JetBrains security advisories (jetbrains.com/security) to identify affected version ranges and obtain patched releases
- Critical path: Apply patches to all affected instances within 48 hours, prioritizing internet-exposed systems
- If network-isolated: Deprioritize but do not defer past 72 hours
- If unpatched and internet-facing: Isolate from network immediately pending patch application
- Post-patch: Review TeamCity build logs, authentication logs, and artifact repositories for signs of unauthorized access or artifact tampering during the vulnerability window
- Supply-chain review: If TeamCity was used to build or publish software artifacts, inspect those artifacts for backdoors or tampering
INFORMATION GAPS (FLAGGED AS UNCONFIRMED):
- Specific affected TeamCity versions not listed in available sources
- Exact patch version numbers and release dates not provided
- Active exploitation in the wild: status unknown
- CVSS score not stated
- Cloud-hosted TeamCity exposure status not addressed
SOURCES:
- news4hackers: JetBrains TeamCity Unauthenticated RCE Vulnerability Patched (CVE-2026-63077)
- Help Net Security: JetBrains fixes critical unauthenticated RCE in TeamCity On-Premises (CVE-2026-63077)
- securityaffairs: JetBrains Patches Critical TeamCity Flaw Allowing Server Takeover
Recent high-severity events at publish time:
