Critical TeamCity flaw lets unauthenticated attackers run commands on the CI server

JetBrains patched a critical flaw in TeamCity, its continuous integration and delivery server, that lets an unauthenticated attacker run operating-system commands. Tracked as CVE-2026-63077 and scored 9.8, the deserialization bug affects all on-premises versions and is reached through the agent polling protocol, letting an attacker with HTTP access bypass authentication and execute commands with the privileges of the server process. JetBrains warns that exploitation exposes stored credentials and can compromise the integrity of the build pipeline. It is fixed in versions 2025.11.7 and 2026.1.3, with a patch plugin for older releases, and TeamCity Cloud is already updated. No exploitation has been reported.

Check

Upgrade on-premises TeamCity to 2025.11.7 or 2026.1.3, or apply the security patch plugin if you cannot upgrade, and restrict network access to the server.

Affected

Organizations running any on-premises TeamCity version (CVE-2026-63077); an unauthenticated attacker with HTTP access can execute commands as the server process, steal stored credentials, and tamper with build pipelines.

Fix

Patch or apply the plugin, keep TeamCity off the public internet or behind a VPN, rotate credentials the server held, and review build configurations and logs for unauthorized changes.