❦The Daily Commit❦ ☾The Nightly Build☽

JetBrains has closed a critical security vulnerability in its TeamCity build and deployment server, disclosed on July 10 and tracked as CVE-2026-63077. The flaw carries a CVSS score of 9.8 out of 10 and sits in the TeamCity agent polling protocol. It affects all on-premises versions of the CI/CD server; TeamCity Cloud customers do not need to take action.

A successful attacker could slip past every authentication check the software performs and then run whatever operating-system commands they choose on the affected server. What happens next depends on the privileges assigned to the server process: TeamCity data, settings and saved credentials could be exposed, or the server's state altered outright — putting an entire CI/CD pipeline at risk. JetBrains says it had no evidence of active exploitation as of the disclosure date.

The fixed releases are TeamCity 2025.11.7 and 2026.1.3, both also installable via the built-in automatic update mechanism. For older installations, JetBrains provides a security patch plugin that works with server versions from 2017.1 onward.

As an extra safeguard, JetBrains suggests limiting on-premises server access to trusted networks, granting the server as few operating-system privileges as possible, and keeping TeamCity servers on their own machines rather than sharing hosts with build agents. On-premises TeamCity servers have been targeted repeatedly in recent years, including vulnerabilities filed as CVE-2024-23917 (CVSS 9.8) and CVE-2024-27199 (CVSS 7.3).