Overview
- JetBrains disclosed the flaw on July 27–28 and released fixed TeamCity builds (2025.11.7 and 2026.1.3) plus a security‑patch plugin for versions 2017.1 and later.
- The vulnerability, tracked as CVE‑2026‑63077 with a CVSS score of 9.8, let an unauthenticated actor use the agent polling protocol to bypass authentication and execute arbitrary OS commands as the server process.
- JetBrains says TeamCity Cloud is already protected and that there was no evidence of active exploitation when the advisory was published.
- Administrators are urged to upgrade or install the patch plugin immediately because the plugin fixes only this CVE and some older TeamCity releases require a server restart after plugin installation.
- Security firms and the vendor recommend defence‑in‑depth controls for internet‑facing instances such as VPN or firewall restrictions, running servers with minimal OS privileges, and keeping CI/CD hosts separate from build agents to limit credential and pipeline compromise.