🛡️ **CRITICAL: JetBrains TeamCity Unauthenticated RCE — CVE-2026-63077**
Published Tuesday, July 28, 2026 at 03:55 PM PT BLUF: JetBrains has released a patch for CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in TeamCity On-Premises that permits complete server takeover. Organizations running unpatched deployments face immediate risk of infrastructure compromise. DETAILS: Vulnerability: Unauthenticated RCE in JetBrains TeamCity On-Premises; no authentication bypass required Severity: Critical; results in full server compromise and code execution Attack surface: Accessible to any network-adjacent threat actor; exploitation is trivial once vulnerability is known Patch status: Patches released by JetBrains; specific affected versions and patch version numbers are not detailed in available sources Deployment scope: Confirmed for On-Premises deployments; cloud-hosted TeamCity status unclear from available material IMPACT: Any organization operating vulnerable TeamCity On-Premises instances is exposed to unauthenticated attackers capable of executing arbitrary code with server privileges. This permits complete infrastructure compromise including credential harvesting, CI/CD pipeline poisoning (with downstream supply-chain risk), lateral movement into connected systems, and data exfiltration. ...