CYBERSECURITYJuly 28, 20261 min read

Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In

JetBrains has issued an urgent security update for TeamCity On-Premises to fix a critical flaw (CVE-2026-63077, CVSS 9.8) that allows unauthenticated remote code execution. Users are advised to patch immediately or apply security plugins to mitigate risk.

JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution.

The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already been updated. JetBrains has credited Antoni Tremblay with discovering and reporting the flaw on July 10, 2026.

"If exploited, this flaw may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process," JetBrains said.

The flaw allows unauthenticated remote code execution via the agent polling protocol to sidestep authentication checks and achieve command execution. Depending on the privileges granted to the TeamCity server process, a successful compromise can lead to the exposure of TeamCity data, configurations, and stored credentials, or modification of server state.

Besides releasing versions 2025.11.7 and 2026.1.3, JetBrains has released a security patch plugin for versions 2017.1+ so that customers who are unable to apply an update can still patch their environments. There is no evidence to indicate that the flaw has been exploited in the wild.

"The security patch plugin will address only the vulnerability described above (CVE-2026-63077)," JetBrains cautioned. "We always recommend upgrading your server to the latest version to benefit from many other security updates."

As best practices, customers are advised to consider requiring VPN connections or implementing an extra layer of security to prevent unauthorized access to internet-facing TeamCity servers.

"Even exposing the TeamCity login screen or REST API can provide attackers with potential entry points to exploit newly disclosed vulnerabilities," it added.

Source: The Hacker News

More in this category

cybersecurity

TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments

Cybersecurity researchers have uncovered a new cyber campaign targeting Middle Eastern government entities using previously unknown malware families, including TELESHIM, which abuses Telegram's API for command-and-control communication.

cybersecurity

Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable

A malvertising operation named SourTrade forces victims' browsers to assemble Windows executable malware on the fly using a clean Bun runtime. By generating session-unique file hashes, the attackers bypass traditional signature-based detection mechanisms.

cybersecurity

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

Security firms report active exploitation of a critical RCE vulnerability (CVE-2026-16723) in Alibaba's Fastjson 1.x library. With no official patch currently available, organizations are advised to enable SafeMode or migrate to Fastjson2 immediately.

cybersecurity

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

Security researchers published working exploit code for a GitLab flaw patched earlier, allowing authenticated users with commit rights to execute arbitrary commands on unpatched servers.

cybersecurity

CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking

CTM360 research reveals that insurance-focused phishing has evolved from static credential harvesting to real-time account hijacking. Attackers leverage sponsored Google Ads and specialized frameworks like 'InsureOTP Kit' to bypass multi-factor authentication seamlessly.

cybersecurity

BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery

North Korean threat actor BlueNoroff is deploying an advanced phishing kit impersonating Zoom and Microsoft Teams to target cryptocurrency professionals. The kit profiles browser crypto wallets and uses AI-generated video lures before delivering ClickFix-style malware.