Critical JetBrains TeamCity Flaw Lets Attackers Run Commands Without Logging In

JetBrains fixes critical TeamCity flaw allowing remote command execution. Upgrade now to secure stored credentials and configuration files.

By Content Team

Aug 2, 2026

ON THIS PAGE

JetBrains has patched a critical vulnerability (CVE-2026-63077, CVSS 9.8) in TeamCity On-Premises that lets attackers execute OS commands remotely — no credentials required. All versions are affected. An attacker only needs HTTP or HTTPS access to exploit the flaw, which lives in the TeamCity agent polling protocol.

A successful attack could expose stored credentials, build secrets, and configuration files, or allow code injection into software releases. Security researcher Antoni Tremblay privately reported the issue on July 10, 2026.

Fixed versions 2025.11.7 and 2026.1.3 are available now. Admins who can't upgrade immediately can install a temporary security patch plugin, which supports TeamCity 2017.1 and later. TeamCity Cloud is unaffected, so cloud customers need take no action.

Updated 11 Aug 2026: CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on 5 August, and JetBrains issued a follow-up advisory on 7 August confirming reports of attacks against unpatched servers.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?