JetBrains has issued emergency patches for a critical flaw in TeamCity On-Premises that allows unauthenticated attackers to execute arbitrary operating system commands. The company is urging all self-hosted customers to apply the updates immediately.
The vulnerability, tracked as CVE-2026-63077 and assigned a CVSS score of 9.8, impacts every version of the on-premise CI/CD server. According to reporting by The Hacker News, exploitation requires only network access to a TeamCity instance—no authentication is needed. This combination of pre-authentication access and full remote code execution places the flaw among the most severe threats to development infrastructure.
Fixes are available in TeamCity versions 2025.11.7 for the 2025.x line and 2026.1.3 for the 2026.x line. JetBrains notes that TeamCity Cloud instances have already been patched and are not affected. The full burden of remediation therefore falls on operators of self-hosted deployments.
Why Build Servers Are High-Value Targets
A compromised TeamCity server can grant attackers access to source code repositories, signing keys, deployment credentials, and the ability to modify build artifacts. In practice, this means an intruder could inject malicious code into software destined for production, potentially triggering a widespread supply-chain incident.
Security experts have consistently argued that CI/CD platforms warrant the same level of hardening and patch urgency as internet-facing production systems. CVE-2026-63077 underscores that development tooling is critical infrastructure, not a secondary concern.
Immediate Actions for Operators
The primary solution is straightforward: upgrade all on-premises servers to the patched versions as soon as operationally possible. Where immediate patching isn't feasible, JetBrains and security advisors recommend implementing strict network isolation so that only trusted internal hosts can reach the management interface. This is a temporary containment measure, not a replacement for the official fix.
Organizations should also use this incident to re-evaluate their broader DevSecOps posture. Self-hosted build systems, artifact repositories, and connected toolchain components must be inventoried, monitored, and included in rapid patch-management processes. Enhanced logging, anomaly detection, and least-privilege access controls can reduce both the likelihood and potential impact of similar vulnerabilities.
The Shared Responsibility Model
The divergent outcomes for TeamCity Cloud and On-Premises deployments highlight a familiar responsibility split. Cloud tenants received the patch automatically, while self-hosted operators must act independently. Teams that chose on-premises installations for reasons of data residency, customization, or compliance should ensure their security programs account for this operational responsibility.
This episode serves as a reminder that both commercial and open-source development tools are high-value targets due to their privileged position in software delivery chains. Maintaining current versions, limiting network exposure, and integrating toolchain components into organizational security monitoring are essential practices, not optional enhancements.
Administrators who have not yet verified their TeamCity version should do so now and schedule the upgrade without delay. Detailed technical guidance is available from JetBrains' official security advisories.
JetBrains 已針對 TeamCity 本地部署版本中一個允許未經認證攻擊者執行任意操作系統命令的嚴重漏洞發出緊急修補程式。公司強烈敦促所有自行託管的客戶立即應用更新。
此漏洞被編號為 CVE-2026-63077，CVSS 評分為 9.8，影響所有版本的本地部署 CI/CD 伺服器。據 The Hacker News 報導，利用此漏洞僅需能訪問 TeamCity 實例的網絡連線——無需任何認證。這種結合了預先認證訪問與完整遠端程式碼執行能力的漏洞，已成為對開發基礎設施最嚴重的威脅之一。
修補程式已於 TeamCity 2025.x 系列的 2025.11.7 版本及 2026.x 系列的 2026.1.3 版本中提供。JetBrains 指出，TeamCity Cloud 實例已進行修補且未受影響。因此，修復工作的全部責任落在自行託管部署的運營者身上。
為何構建伺服器成為高價值攻擊目標
受感染的 TeamCity 伺服器可能使攻擊者得以存取原始碼儲存庫、簽署金鑰、部署憑證，並具備修改構建產出的能力。實際上，這意味著入侵者可將惡意代碼注入即將投入生產環境的軟件中，可能引發大規模供應鏈安全事件。
網絡安全專家一直主張，CI/CD 平台應獲得與面向互聯網的生產系統同等級別的加固與修補優先級。CVE-2026-63077 再次印證，開發工具屬於關鍵基礎設施，而非次要考量。
運營者需即時採取的行動
主要解決方案十分明確：盡快將所有本地部署伺服器升級至已修補的版本。若無法即時進行修補，JetBrains 及安全顧問建議實施嚴格的網絡隔離措施，僅允許受信任的內部主機訪問管理介面。這是一項臨時的遏制措施，並不能取代官方修補程式。
各組織亦應藉此事件重新評估其整體的 DevSecOps 姿態。自行託管的構建系統、軟件構件儲存庫及關聯的工具鏈組件必須被盤點、監控，並納入快速的補丁管理流程中。增強的日誌記錄、異常偵測與最低權限存取控制措施，可降低類似漏洞出現的可能性及潛在影響。
共享責任模型
TeamCity Cloud 與本地部署版本的不同處理結果，凸顯了熟悉的責任劃分模式。雲端租戶自動獲得了修補程式，而自行託管的運營者則必須獨立採取行動。基於數據存放地、定制化或合規性等考量而選擇本地安裝的團隊，應確保其安全方案涵蓋此運營責任。
此事件提醒我們，商業及開源開發工具因其在軟件交付鏈中的特權地位而成為高價值攻擊目標。維持最新版本、限制網絡暴露範圍，以及將工具鏈組件整合至組織的安全監控體系，皆為必要實踐，並非可選的增強措施。
尚未驗證自身 TeamCity 版本的管理員應立即進行檢查，並毫不延遲地安排升級。詳細的技術指南可參閱 JetBrains 的官方安全公告。