CVE Tools
Track your stack

JetBrains fixes critical unauthenticated RCE in TeamCity On-Premises (CVE-2026-63077)

Help Net SecurityBy Zeljka Zorz

PatchTeamCity On-Premises

Our summary

JetBrains has addressed a high-severity remote code execution flaw (CVE-2026-63077) impacting its self-hosted TeamCity On-Premises product. The vulnerability allows attackers to bypass authentication and execute arbitrary commands on the server, potentially leading to full system compromise. Admins are advised to update to version 2025.11.7 or 2026.1.3 immediately or apply the provided security patch plugin for older versions. JetBrains confirmed no active exploitation attempts have been observed.

Read at Help Net Security

Help Net Security publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker NewsChina-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central FlawCVE-2024-27198, CVE-2024-27199
  2. BleepingComputerCISA: Ransomware gangs now exploiting critical TeamCity flawCVE-2026-63077
  3. The Hacker NewsAttackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS CredentialsCVE-2026-63077
  4. Rapid7 BlogRapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)CVE-2026-63077
  5. The Hacker NewsCISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the WildCVE-2026-63077
  6. SecurityWeekHackers Start Exploiting Recent JetBrains TeamCity VulnerabilityCVE-2026-63077
  7. The Hacker News⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS HijacksCVE-2026-63077
  8. Check Point Research3rd August – Threat Intelligence ReportCVE-2026-63077
  9. Help Net SecurityWeek in review: Claude breached three companies during tests, AD CS domain-takeover PoC releasedCVE-2026-63077
  10. SecurityWeekCritical Code Execution Vulnerability Patched in TeamCityCVE-2026-63077

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store