Particle.news
Download on the App Store

JetBrains Patches Critical RCE in TeamCity On‑Premises

The update closes an authentication‑bypass bug that allowed unauthenticated HTTP(S) requests to run operating‑system commands on self‑hosted TeamCity servers, creating urgent risk for exposed instances.

Overview

  • JetBrains disclosed the flaw on July 27–28 and released fixed TeamCity builds (2025.11.7 and 2026.1.3) plus a security‑patch plugin for versions 2017.1 and later.
  • The vulnerability, tracked as CVE‑2026‑63077 with a CVSS score of 9.8, let an unauthenticated actor use the agent polling protocol to bypass authentication and execute arbitrary OS commands as the server process.
  • JetBrains says TeamCity Cloud is already protected and that there was no evidence of active exploitation when the advisory was published.
  • Administrators are urged to upgrade or install the patch plugin immediately because the plugin fixes only this CVE and some older TeamCity releases require a server restart after plugin installation.
  • Security firms and the vendor recommend defence‑in‑depth controls for internet‑facing instances such as VPN or firewall restrictions, running servers with minimal OS privileges, and keeping CI/CD hosts separate from build agents to limit credential and pipeline compromise.