JetBrains Fixes Critical TeamCity RCE Flaw CVE-2026-63077
JetBrains Patches Critical Unauthenticated RCE Flaw in TeamCity
Related Entities(initial)
Organizations
Products & Tech
CVE Identifiers
Full Report(when first published)
Executive Summary
JetBrains has released an urgent security update to address a critical unauthenticated remote code execution (RCE) vulnerability in its TeamCity On-Premises CI/CD platform. The vulnerability, tracked as CVE-2026-63077, has a CVSS score of 9.8 and affects all versions of the self-hosted product. An attacker with HTTP(S) access to a vulnerable server can exploit a flaw in the agent polling protocol to completely bypass authentication and execute arbitrary commands with the permissions of the TeamCity server process. This poses a catastrophic risk to software development pipelines, potentially allowing attackers to steal source code, inject malicious code into build artifacts, and launch widespread supply chain attacks. JetBrains has released patched versions and a security plugin and strongly advises all on-premises customers to update immediately.
Vulnerability Details
The vulnerability exists in the way TeamCity servers handle requests from build agents. The flaw is located in the agent polling protocol endpoint. By sending a specially crafted request to this endpoint, a remote, unauthenticated attacker can circumvent all security checks. This allows the attacker to execute arbitrary operating system commands on the TeamCity server. The commands run with the same privileges as the TeamCity server process, which is often a highly privileged account.
A successful exploit gives an attacker full control over the TeamCity server, which is a 'crown jewel' asset in any software development organization. The potential for follow-on supply chain attacks is extremely high.
Affected Systems
- Product: JetBrains TeamCity On-Premises
- Affected Versions: All versions prior to the patched releases.
Patched Versions:
2025.11.72026.1.3
For users unable to upgrade immediately, a security patch plugin is available for TeamCity versions 2017.1 and newer. TeamCity Cloud instances have already been patched by JetBrains and are not vulnerable.
Exploitation Status
At the time of disclosure on July 27, 2026, JetBrains was not aware of any public exploits or in-the-wild exploitation. However, given the critical nature of the flaw (unauthenticated RCE with a 9.8 CVSS score) and the high value of TeamCity servers as targets, it is highly probable that threat actors will rapidly develop and deploy exploits. Organizations should assume exploitation is imminent.
Impact Assessment
A compromise of a TeamCity server is a worst-case scenario for a development organization. The impact includes:
- Source Code Theft: Attackers can access all source code repositories connected to TeamCity.
- Credential Theft: The server contains secrets, API keys, and credentials used in build processes, which can be stolen to pivot to other systems (cloud environments, package registries, etc.).
- Software Supply Chain Compromise: This is the most severe risk. Attackers can modify build scripts to inject malware, backdoors, or credential stealers into the software being built. This malicious code would then be signed and distributed to the organization's customers, leading to a massive supply chain attack similar to the SolarWinds incident.
- Lateral Movement: The compromised server can be used as a powerful pivot point to attack the internal development network.
IOCs — Directly from Articles
No specific Indicators of Compromise were mentioned in the source articles.
Cyber Observables — Hunting Hints
Security teams should hunt for the following patterns to identify potential exploitation:
- URL Patterns: Monitor web server and reverse proxy logs for unusual requests to TeamCity agent polling endpoints, such as
/app/rest/agents/or similar paths, especially from IP addresses that are not known build agents. - Process Monitoring: On the TeamCity server, monitor for the server process (e.g.,
java.exe) spawning unexpected child processes likecmd.exe,powershell.exe,/bin/bash,curl, orwget. This is a strong indicator of RCE. - Network Connections: Look for unexpected outbound network connections from the TeamCity server to unknown IP addresses. This could be the attacker establishing a reverse shell or exfiltrating data.
- File System Changes: Monitor for the creation of unexpected files (scripts, binaries) in directories writable by the TeamCity server process.
Detection & Response
- Log Analysis: Ingest TeamCity and web server logs into a SIEM. Create alerts for the cyber observables listed above, particularly anomalous process creation originating from the TeamCity service.
- Network Intrusion Detection: Deploy NIDS signatures that can detect exploit attempts against CVE-2026-63077. Monitor all traffic to the TeamCity server's web interface.
- File Integrity Monitoring (FIM): Use FIM on the TeamCity server to alert on changes to critical build configuration files (
.xml) or the creation of suspicious executable files.
Mitigation
- Upgrade Immediately: The primary and most effective mitigation is to upgrade to a patched version (
2025.11.7or2026.1.3). This is an urgent requirement. This aligns with M1051 - Update Software. - Apply Security Plugin: If an immediate upgrade is impossible, apply the security patch plugin provided by JetBrains. This is a temporary measure until a full upgrade can be performed.
- Restrict Access: Ensure the TeamCity server is not exposed to the public internet. Access should be restricted to trusted IP addresses (like corporate VPNs and known build agent locations). This is a form of M1035 - Limit Access to Resource Over Network.
- Web Application Firewall (WAF): Place a WAF in front of the TeamCity server to provide an additional layer of defense and to apply virtual patching rules once they become available.
Timeline of Events
Article Updates
August 4, 2026
Severity increasedNew analysis highlights historical targeting of TeamCity by nation-state actors, increasing urgency for patching CVE-2026-63077. Enhanced detection and mitigation guidance provided.
While no active exploitation of CVE-2026-63077 has been observed, new reports emphasize that CI/CD platforms like TeamCity are high-value targets for sophisticated threat actors, including nation-state groups. This historical context underscores the critical need for immediate patching. Additionally, updated guidance now includes more structured cyber observables, detection strategies with D3FEND mappings, and enhanced mitigation advice, reinforcing the importance of network isolation and credential rotation post-patching.
Update Sources:
August 6, 2026
Severity increasedJetBrains TeamCity RCE (CVE-2026-63077) is now actively exploited in the wild. CISA added it to KEV, mandating federal agencies to patch within three days.
A critical (CVSS 9.8) insecure deserialization vulnerability in JetBrains TeamCity (CVE-2026-63077) is now under active attack. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities (KEV) catalog on August 6, 2026. This official confirmation of in-the-wild exploitation mandates U.S. federal agencies to apply patches within three days. All organizations using on-premises TeamCity servers are urged to assume compromise if unpatched and apply the late July 2026 security updates immediately to mitigate severe software supply chain risks.
Update Sources:
Timeline of Events
Security researcher Antoni Tremblay privately discloses the vulnerability to JetBrains.
JetBrains releases a security advisory and patches for CVE-2026-63077.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.