Senior Software Developer

Critical JetBrains flaw allows attackers to execute malicious code remotely - update Now. Spread the love July 31, 2026 JetBrains has announced a critical vulnerability in TeamCity On-Premises, identified as CVE-2026-63077. This vulnerability allows attackers to bypass authentication and execute arbitrary commands remotely. It affects all versions of TeamCity On-Premises. An attacker only requires HTTP or HTTPS access to a vulnerable TeamCity server to exploit this issue, with no need for a valid account, password, or prior access. According to JetBrains, the flaw resides in the TeamCity agent polling protocol. A remote attacker can use this protocol to bypass authentication checks and execute operating system commands with the same privileges as the TeamCity server process. This level of access poses serious risks for organizations that use TeamCity to manage software builds, releases, and CI/CD pipelines. A successful attack could expose stored credentials, configuration files, build data, and project secrets. Additionally, attackers could alter build settings, modify artifacts, or inject malicious code into downstream software releases. JetBrains vulnerability. JetBrains assigned the identifier CVE-2026-63077 to this issue after it was privately reported on July 10, 2026, by security researcher Antoni Tremblay through the company's coordinated disclosure process. The company has patched the vulnerability in TeamCity versions 2025.11.7 and 2026.1.3. Administrators are urged to download and install one of these versions immediately or use the built-in automatic update feature where available. For organizations that cannot upgrade immediately, a dedicated security patch plugin can be installed. This plugin supports TeamCity versions 2017.1 and later and specifically addresses CVE-2026-63077. However, JetBrains emphasizes that applying the plugin is only a temporary solution, as a full version upgrade also provides important security fixes. For users of TeamCity version 2024.03 and later, the platform can automatically download available security patch plugins and, when notifications are enabled, notify administrators. Security updates can be checked from the Administration menu under Updates and Available Security Updates. It's important to note that servers running TeamCity versions 2017.1 through 2018.1 will require a restart after installing the plugin. In contrast, TeamCity version 2018.2 and later can enable the patch plugin without restarting the server. JetBrains has confirmed that TeamCity Cloud customers do not need to take any action, as the company has already implemented protections in its cloud environments and found no evidence of exploitation of this flaw in TeamCity Cloud instances. At the time of this announcement, JetBrains indicated that it was unaware of any active exploitation in the wild. Nevertheless, the risk of unauthenticated remote code execution makes immediate remediation crucial. Administrators should also restrict TeamCity access to trusted networks, place internet-facing instances behind a VPN or another access control layer, and run the TeamCity service with minimal operating system privileges. Hosting TeamCity servers separately from build agents can further mitigate the impact of a potential compromise. Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now. July 28, 2026 JetBrains has urgently released security updates for a critical vulnerability in TeamCity On-Premises that could allow remote attackers to bypass authentication and execute arbitrary operating system commands. This vulnerability, tracked as CVE-2026-63077, affects all versions of TeamCity On-Premises. The company has addressed the issue in TeamCity versions... July 28, 2026 In "Cybersecurity News - Original News Source is cybersecuritynews.com" July 2, 2026 JetBrains has released security updates for a cluster of critical vulnerabilities that enable authentication bypass, account takeover, and remote code execution (RCE) across its on-premise ecosystem, including Hub, YouTrack, IntelliJ-based IDEs, Kotlin, GoLand, and TeamCity. These flaws put development and CI/CD environments at direct risk of compromise... July 2, 2026 In "Cybersecurity News - Original News Source is cybersecuritynews.com" Vulnerability exploits are the third most common way that cybercriminals gain access to target organizations, surpassed only by credential stealing and phishing in 2023. Once illicit access is achieved, intruders can launch ransomware attacks, exfiltrate sensitive data for sale in darknet forums or execute account takeovers, among an extensive array... April 30, 2024 In "Cybersecurity News - Original News Source is cybersecuritynews.com"

Critical TeamCity flaw could let attackers run OS commands without logging in. JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already been updated. JetBrains has credited Antoni Tremblay with discovering and reporting the flaw on July 10, 2026. "If exploited, this flaw may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process," JetBrains said. The flaw allows unauthenticated remote code execution via the agent polling protocol to sidestep authentication checks and achieve command execution. Depending on the privileges granted to the TeamCity server process, a successful compromise can lead to the exposure of TeamCity data, configurations, and stored credentials, or modification of server state. Besides releasing versions 2025.11.7 and 2026.1.3, JetBrains has released a security patch plugin for versions 2017.1+ so that customers who are unable to apply an update can still patch their environments. There is no evidence to indicate that the flaw has been exploited in the wild. "The security patch plugin will address only the vulnerability described above (CVE-2026-63077)," JetBrains cautioned. "We always recommend upgrading your server to the latest version to benefit from many other security updates." As best practices, customers are advised to consider requiring VPN connections or implementing an extra layer of security to prevent unauthorized access to internet-facing TeamCity servers. "Even exposing the TeamCity login screen or REST API can provide attackers with potential entry points to exploit newly disclosed vulnerabilities," it added. Found this article interesting? Follow hosang I.T on Google News, Twitter and LinkedIn to read more exclusive content hosang I.T post.

JetBrains patches critical vulnerabilities in IntelliJ IDEA and TeamCity. Incident overview. JetBrains recently disclosed and patched a set of high-severity vulnerabilities affecting its core product suite, specifically the IntelliJ IDEA integrated development environment and the TeamCity CI/CD server. These flaws, which included critical remote code execution (RCE) vectors, were identified through internal security audits and vulnerability research programs. If left unpatched, these vulnerabilities would have allowed unauthenticated attackers to execute arbitrary code on servers, potentially leading to full system compromise. There is currently no public evidence of active exploitation in the wild, and JetBrains has released updated software versions to mitigate these risks immediately. The affected platforms are widely utilized in enterprise software development lifecycles, making the rapid deployment of these patches vital to maintaining internal developer environment security. Strategic implications. The compromise of CI/CD tools like TeamCity presents a significant 'supply chain' risk, as these systems possess deep integration into the software build pipeline and access to sensitive source code repositories and deployment secrets. For security teams, this incident highlights the necessity of securing development infrastructure with the same rigor as production environments. Long-term risks include the potential for threat actors to inject malicious code into software artifacts during the build process, which could result in downstream distribution of tainted applications. Organizations must consider the operational disruption of forced patching cycles and potential non-compliance with secure development frameworks, such as SSDF or SLSA. This event underscores that development toolchains are high-value targets for advanced persistent threats seeking long-term persistence and intellectual property theft. Critical insights. Security teams should prioritize the immediate identification and patching of all TeamCity and IntelliJ IDEA instances across the enterprise. It is essential to conduct a forensic review of server logs for anomalous administrative logins or unexpected process executions that may indicate prior exploitation attempts. Mitigation strategies should focus on applying official vendor patches, enforcing least-privilege access controls for CI/CD pipeline configurations, and restricting network exposure of management interfaces behind VPNs or zero-trust gateways. Beyond patching, organizations should implement robust monitoring for unauthorized configuration changes within build environments and initiate threat hunting for evidence of lateral movement. Future security postures should emphasize the 'code signing' of software artifacts to ensure build integrity even if the CI/CD pipeline is temporarily compromised, reinforcing a defense-in-depth approach to development operations.