Critical TeamCity RCE Demands Immediate Patching to Secure CI/CD Supply Chains

JetBrains has issued an urgent advisory regarding a critical unauthenticated Remote Code Execution (RCE) vulnerability, identified as CVE-2026-63077, affecting its TeamCity On-Premises continuous integration/continuous delivery (CI/CD) server solution. This severe flaw allows an attacker to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. The vulnerability is exploitable via the TeamCity agent polling protocol, meaning an attacker only needs to reach a vulnerable TeamCity server over HTTP or HTTPS to initiate an attack. JetBrains has confirmed that all TeamCity On-Premises versions released prior to the fixes are affected. This vulnerability is profoundly significant for any organization utilizing TeamCity On-Premises, as it directly impacts the integrity and security of their software supply chain. A successful exploit could lead to catastrophic consequences, including the theft of sensitive source code, the modification of builds to inject malicious payloads, the creation of trojanized artifacts, and the compromise of credentials stored within the CI/CD environment. Furthermore, an attacker could leverage this access for lateral movement within an organization's network. The unauthenticated nature of the RCE makes it particularly dangerous, lowering the barrier for exploitation and increasing the urgency for mitigation. This incident is not isolated but rather fits into a broader, well-established trend of increasing attacks targeting CI/CD systems and the software supply chain. High-profile incidents in recent years have highlighted that CI/CD infrastructure, often holding 'keys to the kingdom' (e.g., deployment secrets, access to production environments), represents a high-value target for adversaries. The industry has been pushing for 'shift-left' security, integrating security practices earlier in the development lifecycle, and emphasizing supply chain security as a paramount concern. Vulnerabilities like CVE-2026-63077 underscore the continuous need for robust security measures, including diligent patching and proactive threat modeling, across all stages of the software development and delivery process. In practice, organizations running TeamCity On-Premises must take immediate action. The primary recommendation is to upgrade to fixed versions, specifically TeamCity 2025.11.7 or 2026.1.3. For those unable to upgrade immediately, JetBrains has released a security patch plugin that can be installed on TeamCity versions 2017.1 and newer. It is crucial to note that this plugin only addresses CVE-2026-63077 and does not substitute for a full update. Additionally, practitioners should limit network access to their TeamCity servers, ideally restricting it to trusted networks or requiring VPN connections for external access. After patching, it is advisable to rebuild high-value releases and artifacts, comparing them against previously published versions to detect any unexplained differences that might indicate a prior compromise. This proactive stance is essential for maintaining the integrity and trustworthiness of software delivered through CI/CD pipelines.