CVE Tools
Track your stack

Critical Code Execution Vulnerability Patched in TeamCity

SecurityWeekBy Ionut Arghire

PatchJetBrains

Our summary

JetBrains has addressed a high-severity vulnerability in TeamCity On-Premises that allows unauthenticated attackers to execute arbitrary code remotely. Tracked as CVE-2026-63077 (CVSS score 9.8), the flaw impacts all on-premises editions and could allow access to sensitive data, server tampering, and CI/CD pipeline manipulation. Patches are available in versions 2025.11.7 and 2026.1.3, with a security plugin offered for older versions.

Read at SecurityWeek

SecurityWeek publishes this story on its own site; we link to it rather than reprint it.

  1. BleepingComputerCISA: Ransomware gangs now exploiting critical TeamCity flawCVE-2026-63077
  2. The Hacker NewsAttackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS CredentialsCVE-2026-63077
  3. Rapid7 BlogRapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)CVE-2026-63077
  4. The Hacker NewsCISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the WildCVE-2026-63077
  5. SecurityWeekHackers Start Exploiting Recent JetBrains TeamCity VulnerabilityCVE-2026-63077
  6. The Hacker News⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS HijacksCVE-2026-63077
  7. Check Point Research3rd August – Threat Intelligence ReportCVE-2026-63077
  8. Help Net SecurityWeek in review: Claude breached three companies during tests, AD CS domain-takeover PoC releasedCVE-2026-63077
  9. BleepingComputerJetBrains warns of critical TeamCity remote code execution flawCVE-2026-63077
  10. Rapid7 BlogCVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCityCVE-2026-63077

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store