Full research report
Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
Executive assessment
CVE-2026-63077 is a well-evidenced critical unauthenticated RCE in all JetBrains TeamCity On-Premises versions, confirmed by the vendor's own advisory and corroborated by multiple independent sources. The vulnerability's location in the agent polling protocol — a channel that must be reachable by build agents — means that any network-exposed TeamCity instance is potentially in scope, and successful exploitation would give an attacker OS-level command execution with access to the full breadth of CI/CD secrets and artefacts the server holds. JetBrains reports no observed exploitation and no public PoC exists as of 28 July 2026, but the vulnerability class and CVSS score of 9.8 place it in the same tier as CVE-2023-42793, which was exploited by North Korean-attributed actors within days of disclosure. The CISA KEV entry appearing in the source metadata (CVE-2026-50522) relates to a separate Microsoft SharePoint RCE with confirmed active exploitation and is not connected to this TeamCity disclosure. Patching or applying the backport plugin, combined with network-level access restriction, are the only reliable controls until organisational exposure can be assessed.
What happened
JetBrains published its advisory for CVE-2026-63077 on 27 July 2026, disclosing a critical authentication-bypass and remote code execution vulnerability in all TeamCity On-Premises versions. Security researcher Antoni Tremblay reported the flaw via responsible disclosure on 10 July 2026. JetBrains released patched versions 2025.11.7 and 2026.1.3, together with a backport security plugin for deployments running version 2017.1 or later that cannot upgrade immediately. No exploitation in the wild had been observed at the time of disclosure.
Affected scope
All JetBrains TeamCity On-Premises versions prior to 2025.11.7 and 2026.1.3; the backport plugin extends coverage to version 2017.1 and later. TeamCity Cloud is not affected. Any organisation with a TeamCity server reachable over HTTP or HTTPS is exposed, making internet-facing CI/CD infrastructure a priority target.
Technical assessment
The vulnerability exists in the agent polling protocol, a channel through which build agents communicate with the TeamCity server. An unauthenticated attacker with network access to the server's HTTP or HTTPS port can exploit a flaw in that protocol to bypass authentication checks and reach privileged execution paths, resulting in OS command execution with the same privileges as the TeamCity server process. Because CI/CD servers routinely hold source-code access tokens, signing keys, cloud credentials, and deployment secrets, a successful compromise can pivot rapidly beyond the TeamCity host itself. The absence of an authentication requirement and the broad version scope make this vulnerability particularly severe.
Recommended defensive actions
- Update TeamCity On-Premises to version 2025.11.7 or 2026.1.3 immediately.
- Apply the JetBrains security patch plugin (available for version 2017.1 and later) on any instance that cannot be upgraded immediately; restart the server if running versions 2017.1–2018.1.
- Restrict network access to TeamCity servers to trusted internal networks or VPN, removing any direct internet-facing exposure.
- Audit the OS account under which the TeamCity server process runs and enforce least-privilege principles, removing unnecessary system or administrator rights.
- Monitor TeamCity server logs and host process telemetry for anomalous unauthenticated requests to agent polling endpoints and unexpected child-process spawning from the TeamCity process.
- Rotate all credentials stored in TeamCity (source control tokens, cloud API keys, signing certificates) as a precautionary measure for any instance that was internet-accessible before patching.
Uncertainties and evidence gaps
- The precise technical mechanism enabling authentication bypass in the agent polling protocol has not been publicly detailed, limiting the ability to write targeted detection signatures ahead of patch deployment.
- No public proof-of-concept was available at the time of disclosure, but TeamCity has a documented history of similar critical vulnerabilities being weaponised within days — notably CVE-2023-42793, which North Korean-attributed actors exploited rapidly after disclosure.
- CVE-2026-50522 (Microsoft SharePoint RCE, CISA KEV-listed 22 July 2026) appeared in the source metadata alongside CVE-2026-63077 but relates to an entirely separate product and incident; it has no confirmed connection to this TeamCity story.
- Secondary reporting attributes the weakness to insecure deserialisation (CWE-502), but this classification does not appear in the verified JetBrains advisory text and should be treated as unconfirmed until independently verified.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No active exploitation confirmed for CVE-2026-63077; JetBrains stated it was unaware of any in-the-wild exploitation at advisory publication on 27 July 2026, and no public proof-of-concept has been identified.
Investigation began by verifying the core claim from the source article — a CVSS 9.8 unauthenticated RCE in all TeamCity On-Premises versions — against the JetBrains vendor advisory as the primary authoritative source. The advisory confirmed the vulnerability details, fixed versions, backport patch plugin, and absence of known exploitation. Two independent secondary sources (Help Net Security and GBHackers) corroborated the patch details and confirmed no public PoC existed at disclosure. A parallel search established that CVE-2026-50522 in the source metadata is a separate Microsoft SharePoint vulnerability and should not be treated as related to this story. No threat-actor attribution, malware, or exploitation evidence was identified.
- What does the primary source article report about CVE-2026-63077?Fetched The Hacker News article named in the source materialthehackernews.com ↗
Confirms CVSS 9.8, unauthenticated RCE via agent polling protocol, all on-premises versions affected, patched in 2025.11.7 / 2026.1.3, security plugin for 2017.1+, reported by Antoni Tremblay on 10 July 2026, no exploitation in the wild.
why Establishes the reported facts before turning to primary vendor evidence to verify them.
- Does the official JetBrains advisory confirm the reported vulnerability details?Fetched JetBrains blog advisory for CVE-2026-63077blog.jetbrains.com ↗
Advisory confirms unauthenticated RCE via agent polling protocol, all on-premises versions affected, fixed in 2025.11.7 and 2026.1.3, security patch plugin available at download.jetbrains.com, no active exploitation known; recommends VPN and least-privilege for server process.
why The vendor advisory is the highest-authority primary source; it either confirms or contradicts secondary reporting. In this case it confirms all key claims.
- Do independent sources corroborate the scope and patch details?Fetched Help Net Security article on CVE-2026-63077helpnetsecurity.com ↗
Confirms all affected versions, both fixed releases, no active exploitation, no PoC; adds that versions 2017.1–2018.1 require a server restart after installing the patch plugin.
why Independent domain corroborating the advisory details and adding operationally useful installation nuance not in the primary advisory summary.
- Are there any technical details or PoC references beyond the advisory?Fetched GBHackers article on CVE-2026-63077gbhackers.com ↗
No public PoC referenced; confirms no exploitation at advisory time; adds recommendation to treat internet-facing TeamCity servers as high-priority remediation targets and to separate servers from build agents.
why Third independent source confirming no PoC; the additional context on attack surface prioritisation is useful for defensive actions.
- Is there any public PoC or exploit code for CVE-2026-63077?Searched for CVE-2026-63077 proof of concept exploit code
No public PoC found across multiple results; IONIX is tracking exploitation attempts but no code has been released publicly as of 28 July 2026.
why Absence of a public PoC is a material mitigating factor for current exploitation risk, though it does not eliminate future risk given the vulnerability class.
- Does CVE-2026-50522 relate to the TeamCity story or is it a separate event?Searched for CVE-2026-50522 CISA KEV 2026
CVE-2026-50522 is a critical Microsoft SharePoint RCE (CVSS 9.8), added to the CISA KEV catalogue on 22 July 2026, with confirmed active exploitation and public PoC. It is a wholly separate incident involving a different vendor and product.
why Clarifies that the CISA KEV entry in the source metadata was included as adjacent context and should not be listed as a related CVE for the TeamCity story.
Research coverage
All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1655 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| The Hacker Newsnews | ok11 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok7121 records | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok666 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1005 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok9 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Rapid7news | ok5 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sophos IOCsresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 4 opened outside the registered collection
Vulnerability & exploitation2
Vendor & gov advisories1
Primary JetBrains vendor advisory; confirms scope, fixed versions, patch plugin, and no known exploitation
Analysis & research3
Independent corroboration of patch details, exploitation status, and version-specific plugin installation notes
Additional defence-in-depth guidance and confirmation of no public PoC at time of disclosure
Contemporaneous reporting consistent with official advisory; notes plugin covers only CVE-2026-63077