Critical TeamCity Flaw Allows Full Server Takeover — Patch Now

A critical vulnerability in JetBrains TeamCity On-Premises (CVE-2026-63077, CVSS 9.8) lets an unauthenticated attacker execute arbitrary operating system commands on the server. No login required. If your business has ever had custom software built, or uses an in-house development team, there’s a real chance a TeamCity server is sitting somewhere on your network.

What Happened

JetBrains disclosed the flaw on 27 July 2026. It affects all on-premises versions of TeamCity, a widely used build and deployment server. The vulnerability sits in TeamCity’s agent polling protocol and stems from insecure deserialisation of untrusted data. An attacker with HTTP or HTTPS access to the server can bypass authentication entirely and run commands with full system privileges.

JetBrains says there’s no evidence of active exploitation yet, but with public disclosure and a 9.8 CVSS score, exploit code typically follows within days. TeamCity Cloud instances are not affected.

Why This Matters for Australian Businesses

TeamCity is a CI/CD tool — it builds, tests, and deploys software. You might not recognise the name, but if your business has had a web app, internal tool, or integration built by a developer or agency, there’s a reasonable chance TeamCity was part of the pipeline. From what we see across our client base, CI/CD servers are among the most commonly forgotten infrastructure. They get set up for a project, run reliably in the background, and then nobody patches them or reviews their access. They often hold deployment credentials, API keys, and direct access to production systems.

What to Do

• Ask your development team or IT provider whether TeamCity On-Premises is running anywhere in your environment.
• If it is, update to version 2025.11.7 or 2026.1.3 immediately. JetBrains has also released a security patch plugin for those who can’t update straight away.
• Check whether the server is accessible from the internet. If it doesn’t need to be, restrict access to your internal network or VPN.
• Review what credentials and API keys are stored in TeamCity build configurations — if the server was compromised, those credentials should be rotated.

If you’re not sure whether TeamCity or similar build tools are running in your environment, a vulnerability scan will pick it up. All IT includes this in our managed IT support — it’s exactly the kind of forgotten infrastructure that shows up in routine security checks.

Written by Michael Sacco, All IT Services. All IT is a Sydney-based managed IT provider supporting businesses across the Northern Beaches, Central West NSW, Brisbane, and Melbourne.