A significant remote code execution vulnerability exists in JetBrains TeamCity On-Premises, allowing unauthenticated compromise of servers This article explores defenses safeguard unauthorized. . This flaw, identified as CVE-2026-63077, impacts all on-premises versions of TeamCity and has been assigned critical severity due to its potential for complete CI/CD environment compromise.
The vulnerability enables attackers with HTTP or HTTPS access to execute arbitrary commands without valid credentials, including operating system commands under the privileges of the TeamCity server process. This effectively grants full control over the application environment, accessing sensitive configuration data, credentials, and build pipelines. The issue was privately disclosed on July 10, 2026, by security researcher Antoni Tremblay as part of a coordinated disclosure process.
Once exploited, attackers could manipulate build processes, inject malicious code into software artifacts, or exfiltrate sensitive data stored within the CI/CD system. Implementing a Virtual Private Network (VPN) for external login interfaces and APIs, limiting exposure through minimal operating system privileges, and running the server with restricted permissions can significantly reduce attack vectors. Quickly apply patches or install plugins alongside network defenses to safeguard against unauthorized entry and supply chain breaches due to weak CI/CD systems.
