TeamCity CVSS 9.8 RCE demands immediate patching — here's what you need to do

July 27, 2026, JetBrains drops a security advisory. CVSS 9.8 — the maximum severity for a remotely exploitable flaw. Every version of TeamCity On-Premises is affected. The vulnerability: unauthenticated remote code execution on the server that builds, tests, and deploys your code. This is the worst-case scenario for CI/CD infrastructure, and it arrived on a Sunday.

CVE-2026-63077 isn’t the first critical breach in TeamCity, but it is the most severe since CVE-2024-27198 — another CVSS 9.8 that Russian state-backed groups weaponized within days of disclosure. The pattern is well-established. As of July 28, 2026, no active exploitation has been observed. That grace period is measured in hours, not days.

How CVE-2026-63077 works

The vulnerability sits in the TeamCity agent polling protocol — the channel build agents use to register with the server and receive work. An attacker with nothing more than HTTP(S) access to a TeamCity server, even staring at the login page, can bypass authentication entirely and execute arbitrary OS commands with the privileges of the server process.

The attack surface is minimal and the payoff is maximal. Once code executes, the attacker gains access to build configurations, stored credentials (Git tokens, API keys, deployment passwords), build artifacts, and potentially every downstream CI/CD pipeline that trusts the compromised server.

JetBrains spells out the blast radius explicitly: the attacker can “modify server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines.” When your CI server is compromised, so is everything it touches on the way to production.

The vulnerability was discovered and privately reported on July 10, 2026 by researcher Antoni Tremblay under JetBrains’ coordinated disclosure policy. The fix landed in versions 2025.11.7 and 2026.1.3, published July 27.

TeamCity Cloud instances are not affected — JetBrains applied the patches server-side before the advisory went public. On-premises deployments remain fully exposed.

TeamCity’s history as a CI/CD attack magnet

This is not TeamCity’s first encounter with the CVSS ceiling. The JetBrains CI/CD server is a high-value target for a straightforward reason: it holds the keys to the software supply chain.

In December 2023, CVE-2023-42793 (CVSS 9.8) enabled unauthenticated RCE. APT29 — the Russian SVR-linked group also known as Cozy Bear — exploited it at scale, using compromised TeamCity servers as pivot points into target networks. CISA issued a joint advisory with the FBI and NSA specifically naming TeamCity as the initial access vector.

In March 2024, CVE-2024-27198 (CVSS 9.8) allowed attackers to create administrator accounts without authentication. Ransomware affiliates jumped on it immediately, injecting malicious payloads through trusted build pipelines. CVE-2024-27199 (CVSS 7.3), disclosed simultaneously, amplified the damage.

In May 2026, CVE-2026-44413 exposed portions of the TeamCity API to unauthorized post-authentication users — lower severity but a reminder that the attack surface is wide.

The recurrence is structural. A CI/CD server sits between source code and production. Own it, and you can inject backdoors into signed artifacts, exfiltrate deployment secrets, or silently map internal infrastructure. As JetBrains notes: “Even exposing the TeamCity login screen or REST API can provide attackers with potential entry points to exploit newly disclosed vulnerabilities.”

The attack surface compounds because TeamCity integrates natively with virtually every development tool in the ecosystem: GitHub, GitLab, Bitbucket, Docker, Kubernetes, AWS, Azure. Each integration represents an access token stored in the server configuration. A compromise therefore exposes not just source code but credentials for the entire toolchain. In a world where SLSA provenance attestations are becoming table stakes for software supply chain security, a corrupted CI/CD server invalidates the entire downstream trust chain.

The CISA KEV (Known Exploited Vulnerabilities) catalog has included TeamCity entries since CVE-2023-42793. Federal civilian agencies are required to patch KEV-listed vulnerabilities within 21 days. CVE-2026-63077 is not yet on the KEV, but a CVSS 9.8 unauthenticated RCE on a CI/CD server is KEV-eligible the moment the first exploitation is confirmed.

What you need to do right now

JetBrains offers two mitigation paths. Only one is sustainable.

Option 1: Upgrade (recommended)

Move to version 2025.11.7 or 2026.1.3. Both branches include the fix for CVE-2026-63077 plus other security updates.

# Check current version
cat /opt/teamcity/VERSION.txt

# Manual download
wget https://download.jetbrains.com/teamcity/TeamCity-2026.1.3.tar.gz

# Or use the built-in auto-updater
# Administration > Updates > Check for updates

The automatic update path is available from the TeamCity administration interface under Administration → Updates.

Option 2: Apply the security patch plugin

For TeamCity 2017.1+ instances that cannot be upgraded immediately, a security patch plugin is available. It fixes CVE-2026-63077 and nothing else — you are not getting the other security fixes included in the latest releases.

• TeamCity 2017.1 through 2018.1: a server restart is required after installation.
• TeamCity 2018.2 and later: the plugin activates without a restart.
• TeamCity 2024.03 and later: the plugin downloads automatically; administrators are notified under Administration → Updates → Available security updates.

Structural hardening

Beyond the immediate patch, JetBrains recommends several practices that should already be in place:

• Never expose TeamCity to the public internet. If external access is required, route it through a VPN or an additional authentication layer. The login screen alone is an attack surface.
• Run the TeamCity server with minimum OS privileges. The server process should never execute as root or Administrator.
• Separate the server from build agents on dedicated hosts. A server compromise should not grant direct access to build execution environments.
• Restrict network access to trusted IP ranges only.

Verdict

CVE-2026-63077 is a drop-everything vulnerability. If you run TeamCity On-Premises and your server is reachable on any network beyond localhost, apply the fix today. The absence of known active exploitation as of July 28, 2026 is a window, not a guarantee.

If your instance is internet-facing without a VPN, this is a within-the-hour patch. TeamCity’s history is unambiguous: attackers — state-sponsored and criminal alike — monitor JetBrains advisories and automate exploitation within 48 hours. CVE-2023-42793 was exploited in the wild five days after disclosure; CVE-2024-27198 was even faster.

Organizations that cannot patch immediately should deploy the security patch plugin as a stopgap but schedule a full upgrade within seven days. The plugin addresses one vulnerability; recent TeamCity releases bundle dozens of additional security fixes.

TeamCity Cloud customers are not affected. If you have been weighing Cloud versus On-Premises, this latest critical flaw tips the scales further toward managed infrastructure.

References

• JetBrains — Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077), July 27, 2026
• The Hacker News — Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In, July 28, 2026
• Help Net Security — JetBrains fixes critical unauthenticated RCE in TeamCity On-Premises, July 28, 2026
• CISA — Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE, December 2023
• BleepingComputer — CVE-2024-27198 TeamCity flaw exploited by ransomware gangs, March 2024