Critical Unauthenticated RCE Vulnerability CVE-2026-63077 Patched in JetBrains TeamCity On-Prem
Executive Summary
JetBrains has issued an emergency security update for its widely deployed continuous integration and continuous delivery (CI/CD) platform, TeamCity On-Premises, addressing a critical unauthenticated remote code execution (RCE) vulnerability tracked as CVE-2026-63077 (CVSS 9.8).
The security flaw allows remote, unauthenticated attackers to bypass authentication controls and execute arbitrary commands with administrative privileges on vulnerable build servers. Because CI/CD pipelines hold elevated permissions to cloud infrastructure, production codebases, and deployment secrets, unpatched TeamCity servers represent an immediate, high-severity threat to software supply chains globally.
Vulnerability Attribute
Details
Identifier
CVE-2026-63077
CVSS Score
9.8 (Critical)
Impact
Unauthenticated Remote Code Execution (RCE)
Affected Software
JetBrains TeamCity On-Premises
Remediation
Update to version 2026.07.2 or later
Deep-Dive Technical Analysis
The vulnerability stems from improper validation and parsing of HTTP request headers handled by TeamCity's internal web controller endpoints.
Authentication Bypass Mechanism
An unauthenticated remote actor can construct a specialized HTTP query targeting TeamCity's internal REST API controller. By supplying a malformed authentication header combined with path manipulation parameters, the application misinterprets the request session state and elevates the caller to an authenticated administrator context without requiring credentials.
Arbitrary Code Execution Payload
Once elevated, the attacker can leverage default administrative web endpoints designed for plugin installation and process management. By submitting a customized ZIP archive containing a malicious Java archive (JAR) or executable shell script, the attacker triggers immediate code execution in the context of the underlying host operating system user running the TeamCity service (frequently SYSTEM on Windows or root on Linux).
Post-Exploitation Capabilities
Successful exploitation gives threat actors complete access to active environment variables, secret keys, source code repositories, and build artifacts managed by the server. Attackers can tamper with active software builds to inject malicious code (supply-chain contamination) or pivot laterally into connected cloud environments such as AWS, Azure, and GCP.
Industry Impact and Recommendations
The exposure of CI/CD pipeline infrastructure poses catastrophic risks to enterprise software vendors and corporate IT environments.
1. Immediate Patch Deployment: System administrators utilizing JetBrains TeamCity On-Premises must immediately update to version 2026.07.2 or later. Cloud-hosted TeamCity instances (TeamCity Cloud) have already been patched by JetBrains.
2. Network Perimeter Isolation: Restrict access to TeamCity management portals and build agent communication ports behind VPNs or zero-trust network access (ZTNA) controls, preventing direct exposure to the public internet.
3. Secrets Revocation and Audit: Inspect TeamCity server access logs and build agent history for anomalous POST requests to REST API endpoints. If exploitation is suspected, immediately rotate all cloud access keys, private SSH keys, and API tokens stored within TeamCity parameters.