JetBrains Warns of Critical TeamCity On-Premises RCE Flaw
Summary
CVE-2026-63077 can let attackers with HTTPS access bypass authentication and execute commands on TeamCity On-Premises servers. JetBrains fixed the flaw in versions 2025.11.7 and 2026.1.3 and offers a patch plugin; no active exploitation was known at publication.
Key points
- The authentication bypass affects all TeamCity On-Premises versions; TeamCity Cloud is not affected.
- The flaw can enable remote command execution with the privileges of the TeamCity server process.
- JetBrains fixed the issue in versions 2025.11.7 and 2026.1.3.
- A security patch plugin is available for TeamCity 2017.1 and later for customers unable to upgrade.
- JetBrains recommended upgrading or applying the patch; some older versions require a server restart for the update to take effect.
- At the time the advisory was published on July 27, there was no evidence of active exploitation.
Article Details
- Vulnerability Types
- Authentication bypass
- Remote code execution
- Severity
- Critical
- Affected Versions
- TeamCity On-Premises (all versions)
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Upgrade to TeamCity 2025.11.7 or 2026.1.3.
- For customers unable to upgrade, install the security patch plugin available for TeamCity 2017.1+.
- Require VPN access or other protective layers for internet-facing TeamCity servers.
MITRE ATT&CK
CVE
People
Vendors
Products
JetBrains TeamCityJetBrains has disclosed a critical authentication bypass in TeamCity On-Premises, tracked as CVE-2026-63077, that could let attackers achieve remote code execution over HTTPS.TeamCity CloudThe flaw affects all on-premises versions, while TeamCity Cloud is not impacted and already protected.TeamCity On-PremisesJetBrains has disclosed a critical authentication bypass in TeamCity On-Premises, tracked as CVE-2026-63077, that could let attackers achieve remote code execution over HTTPS.