Latest JetBrains TeamCity vulnerability: CVE-2026-63077 #
JetBrains disclosed that certain versions of TeamCity On-Premises are affected by a remote code execution (RCE) vulnerability exploitable via the server's agent polling protocol. Successful exploitation allows a remote, unauthenticated attacker with HTTP(S) access to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. Depending on the service account's permission level, successful compromise enables the attacker to steal sensitive credentials and configurations or alter build outputs, threatening the integrity of build artifacts and downstream CI/CD workflows. The vulnerability has been designated CVE-2026-63077 and has been rated critical with a CVSS score of 9.8.
The following versions are affected
- TeamCity: All On-Premises versions prior to 2026.1.3 and 2025.11.7.
What is JetBrains TeamCity? #
JetBrains TeamCity is a continuous integration and continuous delivery (CI/CD) server that automates the building, testing, and deployment of software applications across distributed build environments.
What is the impact? #
Successful exploitation of this vulnerability would allow an unauthenticated, remote attacker to gain full control over the TeamCity server, enabling them to steal sensitive organizational credentials and compromise the security and integrity of downstream software build pipelines.
Are any updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- TeamCity 2026.x: Upgrade to version 2026.1.3 or later.
- TeamCity 2025.x: Upgrade to version 2025.11.7 or later.
- TeamCity 2024.12.x through 2017.1.x: Apply the official security patch plugin, or upgrade to a supported, fixed release (2026.1.3 or 2025.11.7).
- All older, unsupported product versions: Upgrade to a supported, fixed release (2026.1.3 or 2025.11.7).
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=JetBrains AND product:=TeamCityCVE-2024-27198, CVE-2024-27199 (March 2024) #
On March 3rd, 2024, JetBrains disclosed two serious vulnerabilities in the TeamCity On-Premises product.
The first issue, CVE-2024-27198, allows attackers to bypass authentication controls and access the TeamCity installation with administrative privileges. This issue has been given a CVSS score of 9.8, indicating a highly critical vulnerability.
The second issue, CVE-2024-27199, is a path-traversal vulnerability allowing attackers to perform limited administative actions without proper authentication. This issue has been given a CVSS score of 7.3, indicating a high severity.
What is the impact? #
Upon successful exploitation of these vulnerabilities, attackers can execute arbitrary commands on the vulnerable system. This includes the creation of new users, installation of additional modules or code, and, in general, system compromise.
Are updates/workarounds available? #
JetBrains has released an update to mitigate this issue. Users are urged to update as quickly as possible.
How to find TeamCity installations with runZero #
TeamCity On-Premises assets can be found by navigating to the Asset Inventory and using the following pre-built query to locate TeamCity services on your network:
product:"TeamCity"
Results from the above query should be triaged to determine if they require patching or vendor intervention. Additional fingerprinting research is ongoing, and additional queries will be published as soon as possible.
CVE-2024-23917 (February 2024) #
On February 6th, 2024, JetBrains disclosed a serious vulnerability, CVE-2024-23917, allowing attackers who can access the TeamCity installation via HTTPS to bypass authentication mechanisms and gain administrative privileges on the affected systems.
JetBrains released an update to mitigate this issue. Users were urged to update as quickly as possible.
CVE-2023-42793 (September 2023) #
On September 20th, 2023, JetBrains announced a critical authentication bypass vulnerability that impacted users running the TeamCity On-Premises product. The vulnerability was tracked using CVE-2023-42793, and presented the weakness of CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Successfully exploiting this vulnerability would allow an unauthenticated remote attacker to perform a Remote Code Execution (RCE) attack and gain administrative access to the underlying system.
JetBrains issued a patch for this vulnerability in revision 2023.05.4, encouraging all users to upgrade. For users that could not immediately apply the update, a security patch plugin was also made available. More information can be found on JetBrain’s website.
