JetBrains TeamCity CVE-2026-63077 is a CVSS 9.8 authentication bypass that lets an unauthenticated attacker with HTTP access run arbitrary operating-system commands on the build server — every On-Premises version is affected, and you should upgrade to 2025.11.7 or 2026.1.3 immediately. The flaw lives in the agent polling protocol and, per NVD, stems from insecure deserialization (CWE-502) — the same bug class that has repeatedly turned Java servers into remote-code-execution targets. There is no confirmed in-the-wild exploitation yet, but a build server is one of the highest-value machines in any software organization.

The vulnerability was reported by researcher Antoni Tremblay on July 10, 2026 and fixed in the two current maintenance releases. JetBrains also shipped a security patch plugin covering versions back to 2017.1 for teams that cannot take a full upgrade window immediately. In JetBrains' own words, an attacker can "bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process."

The reason this rates as a drop-everything patch has less to do with the CVSS number and more to do with what a TeamCity server holds. CI/CD servers store deployment credentials, cloud IAM roles, SSH keys, signing material, and the pipelines that push code to production. Command execution there is not a single-host compromise — it is a supply-chain foothold. That is exactly how CVE-2024-27198, the last critical TeamCity auth bypass, played out: mass internet scanning and exploitation began within days of disclosure, and defenders on Hacker News and r/netsec are openly drawing the parallel.

How serious is CVE-2026-63077 and is it being exploited?

It is critical and pre-authentication, which is the worst combination. As of disclosure there is no evidence of active exploitation, but the security consensus is to treat it as a P0 emergency rather than routine maintenance. Deserialization flaws with a clear reachable path are weaponized fast — often inside 12 to 48 hours of a patch shipping — because attackers patch-diff the fix to reconstruct the payload. Any TeamCity instance reachable from the internet should be considered a live target the moment PoC code surfaces.

What should CI/CD teams do right now?

Upgrade first, then hunt and contain. The full sequence: move to a fixed release (or apply the patch plugin), pull the web portal and agent endpoints off the open internet behind a VPN or zero-trust access layer, review HTTP logs for anomalous requests against the agent registration and polling handlers, and — if the instance was internet-exposed at any point — rotate the secrets, SSH keys, and cloud roles it stored.

Our read

A critical, unauthenticated RCE in a build server is the clearest possible case for supervised adversary simulation over point-in-time scanning. The question that matters after a bug like this isn't "did we install the patch" — it's "if an attacker reached this server, what could they actually touch, and would we see it?" Those are answered by exercising the path, not by reading a version string. The TeamCity 2024 episode showed how narrow the window is: the median gap between disclosure and exploitation in 2025's actively-exploited set was 26 days, but for CI/CD deserialization bugs with a public fix to diff, it collapses to days. Treating the build server as an internet-facing crown jewel — isolated, monitored, and regularly red-teamed — is what turns a nine-point-eight from an incident into a patch note.

FAQ

Is TeamCity Cloud affected? The advisory and fixes address TeamCity On-Premises. Cloud instances are managed by JetBrains; On-Premises operators own the patching.

Which version do I need? 2025.11.7 or 2026.1.3. If you can't upgrade today, apply the JetBrains security patch plugin, which covers versions from 2017.1 onward.

Is it being exploited in the wild? No confirmed exploitation at disclosure, but the prior TeamCity auth-bypass (CVE-2024-27198) was mass-exploited within days, so treat this as urgent.

Why is this worse than a normal RCE? Because the target is a CI/CD server holding deployment credentials and pipeline access — command execution there is a route into everything that server can deploy to.

Sources: The Hacker News · NVD — CVE-2026-63077 · JetBrains security bulletins

Reporting by The Hacker News; CVSS, CWE and version details per NVD and JetBrains' advisory.

Related: Ubuntu snap-confine local root (CVE-2026-8933) · What CVSS misses: EPSS, KEV and patch prioritization