JETBRAINS has released patches for a critical unauthenticated code execution flaw in its TeamCity continuous integration server, tracked as CVE-2026-63077 and rated CVSS 9.8 according to its advisory. The vulnerability permits remote attackers to run arbitrary operating system commands without needing any credentials.
The flaw resides in the way the TeamCity web server processes certain requests, where insufficient validation allows unauthenticated code execution as reported by Security Affairs. All on‑premise versions prior to the fixed releases are impacted, while JetBrains cloud services are not affected by this issue. The vulnerability carries a CVSS score of 9.8 due to its network attack vector, low complexity and lack of required privileges or user interaction.
JetBrains has issued patched versions 2025.11.7 and 2026.1.3 that correct the input validation and authentication checks noted by The Hacker News. For environments where an immediate upgrade is not possible, the vendor provides a security patch plugin that mitigates the risk. Administrators should apply either the version upgrade or the plugin as soon as feasible.
As of the advisory date, JetBrains has not observed any active exploitation of CVE-2026-63077 in the wild. However, the combination of a high severity score and a remote unauthenticated attack vector makes it an attractive target for threat actors. Past incidents involving comparable flaws in CI/CD platforms have been leveraged for ransomware deployment and intellectual property theft.
Defenders should prioritise upgrading to the patched releases or installing the official plugin without delay. Network access to the TeamCity web interface ought to be restricted to trusted IP addresses, and multi‑factor authentication should be enforced for any remote administration. Continuous monitoring of server logs for unexpected command execution or privileged escalation attempts is essential. Additionally, maintaining recent, offline backups of configuration and build artefacts will aid recovery should a compromise occur.
Segmenting the build server from other internal network zones limits lateral movement if an attacker gains a foothold. Staying subscribed to JetBrains security mailing lists ensures timely notice of future updates. Administrators are encouraged to review the vendor’s hardening guide for further defensive measures.