Rapid7 published new technical analysis Friday of CVE-2026-63077, a critical TeamCity remote code execution vulnerability affecting on-premises servers. JetBrains says an unauthenticated attacker who can reach a TeamCity server over HTTP or HTTPS may bypass authentication and run operating system commands with the privileges of the server process, placing source code, credentials and software delivery pipelines at risk.

JetBrains disclosed the flaw on July 27 after security researcher Antoni Tremblay privately reported it on July 10. The vendor assigned the issue a critical rating, while its CVE authority assessment gives it a CVSS 3.1 score of 9.8. The NIST National Vulnerability Database lists the weakness as CWE-502, deserialization of untrusted data.

The attack path is exposed through TeamCity's agent polling protocol, according to the vendor advisory. Exploitation requires no account, user interaction or local access when the service is network-reachable. Commands would execute in the security context of the TeamCity server process, so the practical impact depends partly on the operating system permissions granted to that service.

A successful compromise could expose TeamCity data, configuration files and stored credentials, alter server state, and undermine the integrity of build artifacts or downstream CI/CD pipelines, JetBrains said. Those systems often occupy a sensitive position between source repositories, build agents and deployment environments. JetBrains reported no evidence of active exploitation when it published its advisory and provided no vulnerability-specific indicators of compromise.

All TeamCity On-Premises releases before the fixed branches are affected. JetBrains corrected CVE-2026-63077 in versions 2025.11.7 and 2026.1.3 and released a security patch plugin for installations on version 2017.1 or later that cannot immediately upgrade. TeamCity Cloud customers do not need to act because JetBrains applied the required protections and said it found no evidence that cloud environments were exploited through the flaw.

Administrators should update to a fixed release or install the vendor plugin, restrict TeamCity access to trusted networks or a VPN, and run the service with minimum required privileges. JetBrains also recommends separating servers from build agents on dedicated hosts. Defenders should review exposed instances and server activity because the absence of confirmed exploitation at disclosure does not remove the risk posed by an unauthenticated command-execution flaw.