---
title: Critical JetBrains TeamCity Flaw Lets Attackers Run Commands Without Logging In
description: JetBrains fixes critical TeamCity flaw allowing remote command execution. Upgrade now to secure stored credentials and configuration files.
canonical_url: https://codekeeper.co/ticker/jetbrains-teamcity-critical-vulnerability-patch
---

# Critical JetBrains TeamCity Flaw Lets Attackers Run Commands Without Logging In

JetBrains fixes critical TeamCity flaw allowing remote command execution. Upgrade now to secure stored credentials and configuration files.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 2, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fjetbrains-teamcity-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fjetbrains-teamcity-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fjetbrains-teamcity-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fjetbrains-teamcity-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fjetbrains-teamcity-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fjetbrains-teamcity-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

JetBrains has patched a critical vulnerability (CVE-2026-63077, CVSS 9.8) in TeamCity On-Premises that lets attackers execute OS commands remotely — no credentials required. All versions are affected. An attacker only needs HTTP or HTTPS access to exploit the flaw, which lives in the TeamCity agent polling protocol. A successful attack could expose stored credentials, build secrets, and configuration files, or allow code injection into software releases. Security researcher Antoni Tremblay privately reported the issue on July 10, 2026. Fixed versions 2025.11.7 and 2026.1.3 are available now. Admins who can't upgrade immediately can install a temporary security patch plugin, which supports TeamCity 2017.1 and later. TeamCity Cloud is unaffected, so cloud customers need take no action. _Updated 11 Aug 2026: CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on 5 August, and JetBrains issued a follow-up advisory on 7 August confirming reports of attacks against unpatched servers._ **Source:** [Cybersecurity News](https://cybersecuritynews.com/jetbrains-vulnerability-execute-malicious-code/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fjetbrains-teamcity-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fjetbrains-teamcity-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fjetbrains-teamcity-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fjetbrains-teamcity-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fjetbrains-teamcity-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fjetbrains-teamcity-critical-vulnerability-patch%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Ransomware Attack Shuts Down Evanston Township High School Aug 12, 2026](https://codekeeper.co/ticker/ransomware-attack-evanston-high-closure)

[Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack Aug 11, 2026](https://codekeeper.co/ticker/coca-cola-fairlife-ransomware-data-breach)

[Data breaches 153M Driver's Licenses for Sale, and the Trail Leads to One Vendor Sep 7, 2026](https://codekeeper.co/ticker/153m-drivers-licenses-dark-web-breach)

[Software security Critical GitLab AI Gateway Flaw Allows Remote Code Execution Oct 5, 2026](https://codekeeper.co/ticker/gitlab-ai-gateway-security-update)