CVE-2026-63077: An Unauthenticated Shot at Your Build Pipeline
CVE-2026-63077 is a critical TeamCity RCE vulnerability that allows unauthenticated attackers with HTTP(S) access to bypass TeamCity security checks and execute arbitrary operating system commands with the same privileges as the TeamCity server process, directly threatening development server security and downstream software supply chains. The uncomfortable truth is that this is not a niche bug; it is a design-level break in trust for anyone relying on TeamCity On-Premises to build and ship code. Because the flaw is exploitable via the agent polling protocol, an attacker does not need valid credentials or administrative access to start running commands on your CI/CD server. In practice, that turns every exposed TeamCity endpoint into a potential landing zone for compromise, even if you believed your login screen and REST API were safe behind standard authentication.
Why This RCE Is a Serious Supply Chain Security Risk
TeamCity is a widely used CI/CD server that sits at the heart of many enterprise development environments, orchestrating builds, tests, and deployment pipelines. When CVE-2026-63077 allows unauthenticated remote code execution, it is not just about one compromised host; it is about undermining the integrity of everything that host produces. Depending on the privileges granted to the TeamCity server process, attackers can expose TeamCity data, configurations, and stored credentials, modify server state, and "potentially compromise the integrity of build artifacts and downstream CI/CD pipelines." State-sponsored groups and ransomware affiliates have previously targeted unpatched TeamCity On-Premises servers, which means this class of bug is highly attractive to well-resourced adversaries looking for software supply chain footholds. Ignoring this vulnerability is, in effect, trusting that attackers will overlook one of the most strategically valuable points in your development stack.
Who Is Exposed: On-Premises TeamCity Is in the Crosshairs
Every TeamCity On-Premises version is affected by CVE-2026-63077, with a reported CVSS score of 9.8 that correctly reflects the near-total loss of server control if exploited. JetBrains has already fixed the issue for TeamCity Cloud environments and states there is no evidence of exploitation so far, but that is not a reason for self-hosted deployments to be complacent. The highest risk sits squarely with organizations running self-hosted TeamCity servers on their own hardware or cloud infrastructure, particularly where instances are reachable from the internet. JetBrains is explicitly urging admins of these environments to upgrade self-hosted servers as soon as possible, because the attack requires no authentication, no admin credentials, and only basic HTTP(S) access to a TeamCity server. In other words, if your login page or REST API is visible, so is your attack surface.
Required Admin Actions: Patch First, Then Lock Down Access
If you manage TeamCity On-Premises, treating CVE-2026-63077 as an "emergency change" is not overreaction; it is baseline due care. JetBrains has addressed the unauthenticated remote code execution flaw in versions 2025.11.7 and 2026.1.3, and is urging all customers of on-premise deployments to update immediately. Those unable to upgrade right away must install the JetBrains security patch plugin available for versions 2017.1 and above, noting that versions 2017.1–2018.1 require a server restart after installation, while version 2018.2 onward can enable the plugin without a restart. The vendor warns that this security patch plugin only addresses CVE-2026-63077 and does not replace full upgrades for broader security coverage. Delaying these steps is effectively accepting that an unauthenticated attacker can run OS commands through your CI/CD infrastructure.
Hardening Development Server Security Beyond This Patch
Patching CVE-2026-63077 is a minimum requirement, not a complete defense strategy. Development teams should treat this incident as a push to harden overall development server security. JetBrains advises limiting network access to TeamCity servers to trusted networks or, where internet exposure is unavoidable, requiring VPN connections and an additional security layer to reach the service. They explicitly warn that "even exposing the TeamCity login screen or REST API can provide attackers with potential entry points to exploit newly disclosed vulnerabilities." Running the TeamCity server with the minimum operating system privileges required for normal operation further reduces blast radius if something goes wrong. Longer term, teams should review how build agents connect, what secrets are stored in CI/CD systems, and whether their monitoring can detect unusual agent polling or command execution patterns. Secure supply chains start with secure build infrastructure.
