JetBrains Fixes Critical Vulnerability 9.8 in TeamCity That Allows Remote Execution Without Authentication

JetBrains published a notice on July 27th asking all TeamCity On-Premises customers to update to versions 2025.11.7 or 2026.1.3. The company fixed CVE-2026-63077, an insecure deserialization flaw in the polling protocol between the server and build agents, which received a score of 9.8 on CVSS v3.1 and allows remote code execution without any authentication.

The issue is related to CWE-502, deserialization of untrusted data, exposed on the channel that build agents use to query the server for new jobs. An attacker with HTTP or HTTPS access to the server sends a malicious payload to the polling endpoint and gains execution in the TeamCity process, without a session, token, or user interaction. All On-Premises versions prior to the patches are vulnerable.

Researcher Antoni Tremblay reported the vulnerability on July 10th via JetBrains' coordinated disclosure program. The company states that no active exploitation was observed until the warning was published and has also made available a security patch plugin for older installations, supporting from version 2017.1. TeamCity Cloud customers do not need to take action: the managed environment has already been patched.

Installed Base and Global Risk Assessment

According to JetBrains, TeamCity is present in at least 30,000 deployments, with a client list that includes Citibank, Ferrari, Wargaming, and Meta's Oculus division. Market studies by Datanyze place the platform in second position in CI, with an 18.7% market share, trailing only Jenkins and ahead of newer alternatives like GitHub Actions in legacy corporate environments. The concentration is in the United States, Germany, and Australia—the three markets with the highest declared adoption.

CI/CD servers are among the most valued targets by attackers today. Whoever controls TeamCity controls the pipeline, and by extension, the signed binary that goes into production. The inevitable comparison is with the 2023 3CX incident and CircleCI's compromise in the same year, both used as platforms for third-party supply chain attacks. This is why CISA included a previous TeamCity vulnerability, CVE-2024-27198, in its KEV catalog in March 2024, just weeks after the disclosure. At that time, BianLian and other ransomware groups began scanning the internet for exposed servers within 72 hours of the public exploit publication.

The problem is not limited to Frankfurt or San Jose. Delivery centers of Cognizant, Infosys, and TCS in India run TeamCity as part of the stack contracted by American and European banks; a compromised server in Bangalore or Pune opens the door to the client's repository in the City of London. In Brazil, shared services environments of medium-sized banks and engineering teams from São Paulo fintechs use TeamCity as a build orchestrator for Java and .NET, a legacy of JetBrains's historical weight in corporate development. For the CISO here, the takeaway is the same: if the server is exposed to the internet or a broad corporate network, the patch is for immediate application.

What to Do in the Next 48 Hours

JetBrains' direct recommendation: for those on the 2026.x branch, upgrade to 2026.1.3; for those on the 2025.11.x branch, upgrade to 2025.11.7. The patch plugin resolves issues for those stuck on older versions, but does not replace the update. Segregating the TeamCity server from the public internet, although the vendor does not mention the point in the notice, eliminates the main attack vector while reducing the exposure window. Response teams already conducting internal scans with Nuclei or Tenable should prioritize signing as soon as it becomes available, and review the logs of the agent polling endpoint for unusual binary payloads in the last two weeks, the range that covers the period between private reporting and public disclosure.

A final note about timing. Between the date Tremblay reported the vulnerability, July 10th, and the public disclosure on the 27th, seventeen days passed. This is a short window for a fix that involves a protocol change. JetBrains acted quickly following the 2024 incident when Rapid7 broke embargo and forced early disclosure. The question that remains for the client's security team is: how long, now that the CVE is public, until the first exploitation in the wild?