As reported by SecurityAffairs, JetBrains has issued an emergency patch for a critical vulnerability in TeamCity On-Premises that could allow unauthenticated attackers to execute arbitrary commands — effectively handing over complete server control without requiring a single valid credential. This is precisely the kind of flaw that threat actors operationalize within hours of public disclosure.
Vulnerability At a Glance
- CVE ID
- CVE-2026-63077
- CVSS Score / Severity
- 9.8 — Critical
- Vulnerability Type
- Unauthenticated Remote Code Execution (RCE)
- Affected Product
- JetBrains TeamCity On-Premises — all versions prior to the patched release
- Cloud / SaaS Affected?
- No — TeamCity Cloud instances managed by JetBrains are not affected
- Patch Available?
- Yes — update to the latest patched version immediately via the JetBrains security bulletin
- Active Exploitation Observed?
- Not publicly confirmed at time of writing — however, given the history of TeamCity vulnerabilities, weaponization is expected rapidly
Why This Vulnerability Is Exceptionally Dangerous
TeamCity is not a typical enterprise application — it sits at the heart of software build pipelines. A compromised TeamCity server is a compromised software supply chain. Attackers who gain code execution on a TeamCity instance can:
This attack surface mirrors what we observed with prior TeamCity critical flaws (CVE-2023-42793), which were rapidly exploited by North Korean APT actors and ransomware groups alike. A CVSS 9.8 unauthenticated RCE against a CI/CD platform must be treated as a five-alarm event, not a routine patch cycle item.
Who Is Most at Risk
Any organization running TeamCity On-Premises with internet-facing exposure is at the highest risk tier. However, even internally-hosted instances should not be treated as safe — once an attacker achieves initial access to a network through any vector, a vulnerable internal TeamCity server becomes an extremely high-value lateral movement target.
Industries with elevated exposure include:
- Software development firms and ISVs — direct supply chain compromise risk
- Financial services — proprietary trading or banking application pipelines
- Defense and government contractors — classified or sensitive software build environments
- Managed service providers (MSPs) — a single compromised TeamCity instance could cascade across multiple client environments
Shield53 Recommendations — Immediate Actions Required
Priority 1: Patch Now
- Apply the JetBrains-released patch to all TeamCity On-Premises instances without delay — treat this as an out-of-cycle emergency update
- If patching cannot be completed within 24 hours, restrict network access to TeamCity servers immediately (firewall rules, VPN-only access)
Priority 2: Assume Breach Assessment
- Review TeamCity access logs for anomalous authentication attempts, unexpected API calls, or unfamiliar build agent registrations — particularly for activity in the 30–60 days prior to patch awareness
- Audit all build configurations for injected scripts, modified artifact paths, or unauthorized pipeline changes
- Rotate all secrets stored within TeamCity: VCS credentials, deployment tokens, cloud IAM keys, and SSH keys
Priority 3: Harden the Environment
- Enforce network segmentation — TeamCity servers should never be directly internet-accessible; require authenticated VPN or zero-trust gateway access
- Enable TeamCity audit logging and forward logs to your SIEM with alerting on privilege escalation, new admin account creation, and unexpected build agent connections
- Implement integrity monitoring on build output artifacts to detect tampering post-compromise
- Review and minimize the blast radius — restrict the permissions of the service account TeamCity runs under to least privilege
Priority 4: Monitor Threat Intelligence
- Track CISA's Known Exploited Vulnerabilities (KEV) catalog for this CVE — if added, federal agencies have binding remediation deadlines and private sector should mirror that urgency
- Engage your threat intelligence provider to monitor for IOCs associated with exploitation of CVE-2026-63077
Shield53 Position: CI/CD platforms are crown-jewel infrastructure. A 9.8 CVSS unauthenticated RCE in TeamCity is not a vulnerability you schedule — it's one you respond to today. The cost of a supply chain compromise will vastly exceed the cost of an emergency patch window.
The broader lesson here is one security leaders must continue to communicate upward: development infrastructure deserves the same security investment and patching discipline as production systems. In many cases, it warrants more.
