JetBrains Releases Patch for Critical TeamCity RCE Flaw

JetBrains has released an emergency patch for a critical vulnerability in its TeamCity On-Premises software that could allow unauthenticated attackers to execute commands on exposed servers. The company disclosed the flaw, tracked as CVE-2026-63077, on July 27, 2026, and urged administrators to apply fixes immediately.

The vulnerability exists in the TeamCity agent polling protocol and could be exploited without authentication by attackers who can reach a server over HTTP or HTTPS. A successful attack could bypass access controls and run operating system commands with the same privileges as the TeamCity server process. According to the company, this could lead to the exposure of credentials and server configurations, alteration of server state, and compromise of software moving through connected build and deployment pipelines.

Security researcher Antoni Tremblay privately reported the flaw to JetBrains on July 10, 2026. The company stated it was not aware of any active exploitation of the vulnerability at the time of its advisory's publication. JetBrains has already secured its TeamCity Cloud service, and those customers do not need to take action.