A New Flaw Gives Attackers Full Control of TeamCity

A critical flaw in TeamCity lets unauthenticated attackers bypass logins and execute code, giving them full control over vulnerable on-premise servers.

JetBrains has issued an urgent security alert for its popular TeamCity continuous integration and continuous delivery (CI/CD) platform. The company disclosed a critical vulnerability, identified as CVE-2026-63077, affecting all on-premise installations of the software. TeamCity serves as a central hub for automating the building, testing, and deployment of software, making it a foundational piece of infrastructure for thousands of development teams worldwide. According to the advisory published on the JetBrains Blog, this flaw is particularly dangerous because it allows an unauthenticated attacker with simple HTTP or HTTPS access to a TeamCity server to completely bypass all security checks. This grants them the ability to gain administrative control over the server, a severe threat that requires immediate attention from all system administrators.

The technical nature of this vulnerability combines two of the most severe types of security flaws: an authentication bypass and remote code execution (RCE). An authentication bypass means an attacker does not need any valid credentials, such as a username or password, to exploit the system. They can effectively trick the server into granting them privileged access. Once this initial access is gained, the RCE component comes into play. This allows the attacker to run arbitrary commands on the underlying operating system of the TeamCity server with the same permissions as the server process itself. In practice, this means an attacker can install malware, exfiltrate sensitive data, modify system files, or use the compromised server as a launchpad for further attacks within the corporate network. The combination makes this a "walk-right-in" style vulnerability.

Why this matters so much is that a CI/CD server like TeamCity is the nerve center of modern software development, holding the "keys to the kingdom." A successful exploit gives an attacker access to a treasure trove of sensitive assets, including proprietary source code, application secrets, API keys, and credentials for accessing cloud environments like AWS, Google Cloud, or Azure. The most significant risk is a software supply chain attack. An attacker could subtly inject malicious code into an organization's legitimate software during the automated build process. This tainted software would then be signed and distributed to customers, who would have no reason to suspect it was compromised. This attack vector turns a company's own products into a delivery mechanism for malware, echoing the sophisticated tactics seen in major incidents and posing an existential threat to the business.

From a business perspective, failing to address this vulnerability carries catastrophic risk. The direct consequences include the theft of valuable intellectual property and the potential for widespread operational disruption. However, the secondary effects are often more damaging. A successful supply chain attack can lead to a complete loss of customer trust, resulting in significant churn and reputational harm that can take years to repair. The financial fallout includes the high costs of incident response, forensic analysis, and potential regulatory fines. The only practical takeaway for any organization using TeamCity On-Premises is to treat this as a top-priority emergency. JetBrains has released patched versions 2025.11.7 and 2026.1.3, and administrators must upgrade immediately. Threat actors are known to develop exploits and begin scanning the internet for vulnerable systems within hours of such a public disclosure.

This incident highlights a critical and growing area of focus in cybersecurity: the security of the software development lifecycle itself. For years, security efforts primarily concentrated on protecting production environments, but attackers have shifted their focus "left" to the tools developers use every day. CI/CD platforms, code repositories, and package managers are now considered high-value targets. This TeamCity vulnerability is not an isolated event but part of a broader trend of attacks targeting developer infrastructure. It serves as a stark reminder for CTOs and security leaders that their security posture must extend beyond traditional network perimeters. Organizations need robust asset management to know what developer tools are in use, coupled with a rapid, well-practiced patching process to respond to critical vulnerabilities like this one before they can be exploited.

A compromised TeamCity server gives attackers full control over your software supply chain. They can steal source code, inject malware into your products, and access production credentials, creating a company-wide security crisis.

The vulnerability exposes companies to catastrophic risks, including intellectual property theft, supply chain attacks that harm customers, and severe reputational damage. Immediate patching is required to prevent significant financial and operational disruption.