CVE-2026-63077: TeamCity On-Premises Auth Bypass & RCE — Detection and Remediation

JetBrains has released an urgent security advisory addressing a critical vulnerability in TeamCity On-Premises. Tracked as CVE-2026-63077, this flaw carries a CVSS score of 9.8, marking it as Critical. The vulnerability allows unauthenticated attackers to bypass authentication mechanisms entirely and execute arbitrary operating system commands on the underlying server.

Given TeamCity's role as a central CI/CD orchestration point, a compromise here is not just a server breach—it is a potential supply chain catastrophe. Attackers can inject malicious code into build pipelines, steal source code, or pivot laterally into the production environment. Defenders must treat this with the same urgency as an active intrusion.

Technical Analysis

Affected Products:

• JetBrains TeamCity (On-Premises versions only)
• Status: TeamCity Cloud instances are already patched by the vendor.

Vulnerability Details:

• CVE ID: CVE-2026-63077
• CVSS Score: 9.8 (Critical)
• Attack Vector: Network
• Complexity: Low
• Privileges Required: None
• User Interaction: None

Mechanism of Attack: The vulnerability exists in an unspecified authentication endpoint within TeamCity On-Premises. Due to an authentication bypass flaw, an attacker can send a crafted HTTP request to the server without valid credentials. If successful, the server improperly processes this request, leading to Remote Code Execution (RCE) with the privileges of the TeamCity service user.

In a CI/CD context, this often means the attacker gains root or SYSTEM level access, or at minimum, access to the service account which often has write permissions to source code repositories and artifact storage.

Exploitation Status: While the news item describes the potential for exploitation, the severity (CVSS 9.8) and the nature of auth-bypass RCEs suggest that proof-of-concept (PoC) code will likely emerge rapidly. It is highly probable that mass scanning for exposed TeamCity instances is already underway.

Detection & Response

Because this vulnerability bypasses authentication, traditional logins logs may not show suspicious activity. However, the execution of OS commands will result in process lineage anomalies. Specifically, the TeamCity server process (typically Java-based) spawning a shell (bash, sh, cmd.exe, powershell.exe) is a high-fidelity indicator of compromise (IoC) for this specific CVE.

SIGMA Rules

---
title: TeamCity Auth Bypass - Linux Shell Spawn
id: 8a4d9e12-3b5c-4a1f-9d2e-5c6b7a8d9e0f
status: experimental
description: Detects potential exploitation of CVE-2026-63077 by identifying TeamCity (Java) spawning shell processes on Linux.
references:
  - https://blog.jetbrains.com/teamcity/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/java'
    ParentCommandLine|contains:
      - 'teamcity'
    Image|endswith:
      - '/bash'
      - '/sh'
  condition: selection
falsepositives:
  - Legitimate administrative build scripts
level: critical
---
title: TeamCity Auth Bypass - Windows Shell Spawn
id: 9b5e0f23-4c6d-5b2g-0e3f-6d7c8b9e0f1g
status: experimental
description: Detects potential exploitation of CVE-2026-63077 by identifying TeamCity spawning cmd or powershell on Windows.
references:
  - https://blog.jetbrains.com/teamcity/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\java.exe'
    ParentCommandLine|contains:
      - 'TeamCity'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection
falsepositives:
  - Official build agents running scripts
level: critical

KQL (Microsoft Sentinel / Defender)

// Hunt for TeamCity process spawning suspicious child processes
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has_any ("java.exe", "javaw.exe") 
| where InitiatingProcessCommandLine has "TeamCity"
// Look for common shell execution
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh") 
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Velociraptor VQL

-- Hunt for TeamCity parent process spawning shells
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.Commandline AS ParentCmd
FROM pslist()
WHERE Parent.Name =~ "java"
  AND Parent.Cmd =~ "TeamCity"
  AND Name IN ("bash", "sh", "cmd.exe", "powershell.exe")

Remediation Script (Bash)

#!/bin/bash
# Check TeamCity version for CVE-2026-63077 remediation
# Adjust TEAMCITY_HOME path if installed in a non-standard location

TEAMCITY_HOME="/opt/teamcity" 
CURRENT_DATE=$(date +%Y-%m-%d)

echo "[*] Checking TeamCity Version for CVE-2026-63077 mitigation..."

if [ -f "$TEAMCITY_HOME/bin/TeamCity.sh" ]; then
    # Attempt to find version info (varies by install, checking common locations)
    if [ -f "$TEAMCITY_HOME/WEB-INF/build.dist.xml" ]; then
        echo "[+] TeamCity installation found at $TEAMCITY_HOME"
        echo "[!] Please verify manually: Check the TeamCity UI footer or /version.txt for exact version."
        echo "[!] If version is OLDER than 2025.11.7 or 2026.1.3, you are vulnerable."
    else
        echo "[-] TeamCity files not found in standard location. Please check your install path."
    fi
else
    echo "[-] TeamCity not found at $TEAMCITY_HOME."
fi

echo "[+] Remediation: Update to TeamCity 2025.11.7 or 2026.1.3 immediately."

Remediation

1. Immediate Patching: This vulnerability is critical and requires immediate action. JetBrains has released patches in the following versions:

• Update to TeamCity 2025.11.7 or later.
• Update to TeamCity 2026.1.3 or later.

2. Vendor Advisory: Refer to the official JetBrains security bulletin for detailed download instructions:

• URL: https://blog.jetbrains.com/teamcity/

3. Network Isolation (Workaround): If patching is not immediately possible:

• Restrict access to the TeamCity web interface strictly to internal IP ranges via firewall rules.
• Ensure the instance is not exposed directly to the public internet.
• Disallow anonymous guest access if it has been erroneously enabled.

4. Incident Response Check: If you cannot confirm patch status or suspect the server was exposed before patching:

• Review build logs for unauthorized or "broken" builds.
• Audit user accounts for any new, unexpected administrative users created around the time of disclosure.
• Assume all secrets (credentials, API keys, certificates) stored in TeamCity parameters are compromised and rotate them.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub