Critical Team City Flaw Could Let Attackers Run OS Commands Without Logging In
Summary: JetBrains disclosed CVE-2026-63077, a CVSS 9.8 flaw affecting all TeamCity On-Premises versions that lets an unauthenticated attacker with HTTP(S) access bypass authentication checks and execute arbitrary OS commands with the TeamCity server process's privileges via the agent polling protocol. The flaw was reported by Antoni Tremblay on July 10, 2026, fixed in versions 2025.11.7 and 2026.1.3, and a security patch plugin is available for versions 2017.1 and later, with no evidence of exploitation in the wild.
Key Takeaway: A 9.8-rated flaw that needs no credentials and only HTTP(S) reach means any internet-facing TeamCity server is a candidate, and a successful compromise exposes stored credentials and configurations - JetBrains itself warns that even the login screen or REST API is an entry point.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-63077
- Related
- CVE-2026-63077: Jet Brains Team City Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Aug 05, 2026