**JetBrains** is advising customers utilizing on-premise versions of **TeamCity** to update their installations promptly. This urgent recommendation follows the discovery of a critical security vulnerability that could lead to arbitrary code execution, posing a significant risk to affected environments. ### The Vulnerability: CVE-2026-63077 The identified flaw, designated **CVE-2026-63077**, boasts a critical CVSS score of 9.8, underscoring its severity. It impacts all **TeamCity On-Premises** versions and has been rectified in versions 2025.11.7 and 2026.1.3. **TeamCity Cloud** instances have already received the necessary updates. The discovery and reporting of this flaw on July 10, 2026, are credited to **Antoni Tremblay**. According to **JetBrains**, successful exploitation of this vulnerability would enable an unauthenticated attacker, with HTTP(S) access to a **TeamCity** server, to bypass authentication mechanisms. This bypass then facilitates the execution of arbitrary operating system commands with the privileges assigned to the **TeamCity** server process. ### Exploitation and Impact The flaw leverages the agent polling protocol to circumvent authentication checks, leading to remote code execution without prior authentication. A compromise of this nature could expose sensitive **TeamCity** data, configurations, and stored credentials. Furthermore, attackers could modify the server's state, depending on the privilege level of the **TeamCity** server process. ### Patching and Mitigation Beyond the release of updated versions 2025.11.7 and 2026.1.3, **JetBrains** has also made available a [security patch plugin](https://download.jetbrains.com/teamcity/plugins/internal/fix_CVE_2026_63077.zip) for versions 2017.1+. This provides a crucial alternative for customers who are unable to perform a full version upgrade, allowing them to still secure their environments against **CVE-2026-63077**. As of now, there is no indication that this flaw has been exploited in the wild. **JetBrains** emphasized that while the security patch plugin addresses this specific vulnerability, a full upgrade to the latest version is always recommended to benefit from a broader spectrum of security enhancements. ### Best Practices for Enhanced Security As a proactive measure, organizations are advised to implement best practices such as requiring VPN connections for **TeamCity** access or establishing an additional layer of security to restrict unauthorized access to internet-facing **TeamCity** servers. **JetBrains** warns that even exposing the login screen or REST API can create potential entry points for attackers to exploit newly disclosed vulnerabilities.