Critical RCE Vulnerability in JetBrains TeamCity On-Premises Requires Immediate Patching JetBrains has disclosed CVE-2026-63077, a critical remote code execution (RCE) vulnerability affecting its TeamCity On-Premises platform. With a CVSS score of 9.8, the flaw allows unauthenticated attackers with HTTP(S) access to bypass authentication and execute arbitrary OS commands. The vulnerability was reported by security researcher Antoni Tremblay on 10 July and publicly disclosed by JetBrains in a 28 July blog post. All versions of TeamCity On-Premises are impacted, while TeamCity Cloud users are unaffected, as mitigations have already been applied. JetBrains confirmed no exploitation has been observed in cloud environments. Patches are available in TeamCity versions 2025.11.7 and 2026.1.3, with a security patch plugin released for versions 2017.1 and later. However, JetBrains recommends upgrading to the latest version for broader security improvements. Cybersecurity firm Rapid7 echoed the urgency, advising organizations to restrict network access to TeamCity servers as a defense-in-depth measure. The disclosure follows JetBrains’ confirmation that no active exploitation has been detected, but the severity of the flaw underscores the need for immediate action.

JetBrains Patches High-Severity Privilege Escalation Flaw in TeamCity JetBrains has addressed a high-severity vulnerability (CVE-2026-44413) in its TeamCity continuous integration and delivery (CI/CD) platform, urging organizations with on-premises or self-managed deployments to upgrade or apply a security patch. The flaw enables privilege escalation, potentially exposing parts of TeamCity’s REST API to unauthorized users. Compromised endpoints could leak sensitive data, including API tokens, Git credentials, build secrets, passwords, and user details information that could be exploited to access cloud infrastructure or source code repositories. Exploitation requires access to a TeamCity account, which attackers may obtain through brute force, credential stuffing, or social engineering. Some instances also have "guest access" enabled, allowing unauthenticated logins. The vulnerability affects TeamCity On-Premises versions 2025.11.4 and earlier, with fixes available in version 2026.1. JetBrains also released a security patch plugin for versions 2017.1 and later. The company noted that instances with open inbound connections beyond standard HTTP/HTTPS ports or where build agents run on the same host as the server are particularly at risk. TeamCity servers have been frequent targets of cyberattacks, including state-sponsored and financially motivated threat actors exploiting past vulnerabilities (e.g., CVE-2023-42793, CVE-2024-27198). CVE-2026-44413 was privately reported by researcher Martin Orem of Binary House, with no evidence of active exploitation to date.