JetBrains Issues Patch for Critical TeamCity Vulnerability

JetBrains is urging customers of its on‑premises TeamCity servers that a newly identified vulnerability could enable remote code execution with elevated privileges. The flaw, assigned CVE-2026-63077 and scored 9.8 on the CVSS scale, affects all on‑premises versions of TeamCity and was addressed in releases 2025.11.7 and 2026.1.3¹.

The weakness stems from insufficient sanitization of data exchanged between build agents and the server. An attacker who crafts a malicious payload can inject shell commands that are then executed by the CI/CD pipeline as if they were issued locally. Because no user authentication is required, any network actor able to reach the agent channel can trigger full system compromise¹.

JetBrains recommends verifying the installed version via the “About” screen and applying the update through the standard installer or package manager for the host operating system¹. All customers running the self‑hosted product must upgrade immediately or apply the hotfix provided in the two latest patch versions.

Security specialists note that similar input-validation flaws have historically led to persistent backdoors in popular CI tools such as Jenkins (CVE-2019-20836). In practice, the exploit could allow an adversary to install malware, exfiltrate sensitive code, or pivot into other parts of the infrastructure—an especially dangerous scenario when automated pipelines handle proprietary intellectual property. The incident underscores how critical secure coding practices and routine audits of infrastructure components remain essential for organizations relying on continuous integration/deployment workflows¹.