CVE-2026-63077 is a critical vulnerability that has been identified in JetBrains TeamCity On-Premises, as detailed in a security advisory published by JetBrains on July 27, 2026. This unauthenticated vulnerability, which affects all versions of TeamCity On-Premises, is classified as deserialization of untrusted data and carries a CVSS score of 9.8. An unauthenticated remote attacker with HTTP(S) access can exploit this vulnerability to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. Organizations are urged to take immediate action to mitigate this risk.
CVE-2026-63077 Vulnerability Overview
The vulnerability allows attackers to read stored credentials and potentially compromise the integrity of CI/CD pipelines. The impact of successful exploitation is contingent upon the operating system privileges assigned to the TeamCity server process. At the time of the advisory’s release, JetBrains reported no known active exploitation of this vulnerability.
Mitigation Guidance
Organizations utilizing TeamCity On-Premises should prioritize updating to one of the following fixed versions:
- TeamCity 2025.11.7
- TeamCity 2026.1.3
Updates can be performed via the TeamCity UI update workflow or by downloading the fixed versions directly. For those unable to upgrade, JetBrains has provided a security patch plugin for TeamCity 2017.1 and later, which specifically addresses CVE-2026-63077. However, upgrading to a fixed version is recommended to ensure access to other security updates.
Additional Security Recommendations
As a defense-in-depth measure, Rapid7 advises organizations to restrict network access to TeamCity servers, allowing only necessary users and systems. For the latest mitigation guidance, refer to the JetBrains security advisory.
Rapid7 Customer Guidance
Customers of Rapid7’s Exposure Command, InsightVM, and Nexpose can assess their exposure to CVE-2026-63077 using a vulnerability check available in the July 28 content release.
Next Steps
Immediate action is required to update TeamCity On-Premises installations to the fixed versions to mitigate the risk associated with CVE-2026-63077. Organizations should also consider implementing additional security measures to protect their systems.
This advisory is based on information published by www.rapid7.com.
Follow Cyber Warriors Middle East for further cybersecurity advisories, mitigations and defensive resources.
