A critical flaw in JetBrains TeamCity On-Premises servers allows remote attackers to execute arbitrary code without authentication, prompting the company to issue emergency security updates. The vulnerability, tracked as CVE-2026-63077 and carrying a maximum CVSS score of 9.8, poses a significant risk to software development infrastructure and supply chains.
Security researchers have confirmed that all self-managed versions of TeamCity are affected by the issue. An attacker with network access to a vulnerable server requires no credentials to exploit the flaw, gaining command execution with the privileges of the TeamCity process. JetBrains' cloud-hosted service is not impacted; only locally deployed installations face this immediate threat.
The severity is amplified by the central role of CI/CD platforms in modern development pipelines. A compromised TeamCity server often holds source code, build secrets, and deployment credentials, creating a single point of failure. An attacker controlling such a system could potentially inject malicious code into software builds, launching broad supply-chain attacks against downstream users and customers. The unauthenticated nature of CVE-2026-63077 removes the primary hurdle for attackers, making internet-facing instances particularly vulnerable.
JetBrains has released patched builds to address the issue. Administrators of on-premises TeamCity installations are strongly advised to apply the updates immediately. Where patching cannot be done instantly, essential temporary mitigations include restricting network access to the management interface, placing the service behind a VPN or zero-trust access gateway, and actively monitoring logs for suspicious activity. Any TeamCity server exposed to the public internet should be considered high risk until secured.
This incident highlights a persistent trend of targeting build and deployment systems, which have become high-value objectives due to their privileged access within the software development lifecycle. Past vulnerabilities in other CI/CD tools have led to major intrusion campaigns, underlining the necessity for aggressive patch management and strict network segmentation around these critical systems.
For organizations using TeamCity, a structured response is required. Conduct an inventory of all instances and confirm their version. Schedule and apply the vendor-provided security patches as an emergency priority. Harden the environment by auditing firewall rules to minimize exposure, enforcing the principle of least privilege on build agents and secret stores, and documenting all remediation actions for compliance and audit trails.
CVE-2026-63077 serves as a stark reminder that the tools used to build and release software are themselves potent attack vectors. Defending them requires a combination of swift patching, disciplined network hygiene, and vigilant monitoring to protect the integrity of the software supply chain.
JetBrains TeamCity 本地伺服器存在嚴重漏洞，允許遠端攻擊者在未經認證的情況下執行任意代碼，促使該公司發布緊急安全更新。此漏洞被編號為 CVE-2026-63077，CVSS 評分高達最高級別的 9.8 分，對軟件開發基礎設施及供應鏈構成重大風險。
安全研究人員已確認所有自託管版本的 TeamCity 均受此問題影響。攻擊者若能透過網絡存取受影響伺服器，無需任何憑證即可利用此漏洞，取得與 TeamCity 進程同等權限的指令執行能力。JetBrains 雲端託管服務未受影響；僅本地部署的安裝面臨此直接威脅。
由於 CI/CD 平台在現代開發流程中扮演核心角色，此漏洞的嚴重性更為凸顯。遭入侵的 TeamCity 伺服器通常儲存原始碼、建構密鑰及部署憑證，形成單點故障風險。控制此類系統的攻擊者可能將惡意代碼注入軟件建構流程，對下游用戶及客戶發動大規模供應鏈攻擊。CVE-2026-63077 的未認證特性消除了攻擊者的主要障礙，使面向互聯網的實例尤其脆弱。
JetBrains 已發布修復版本以解決此問題。強烈建議所有 TeamCity 本地安裝管理員立即套用更新。若無法即時修補，必要的臨時緩解措施包括：限制管理介面的網絡存取、將服務置於 VPN 或零信任存取閘道後方，以及主動監控日誌中的可疑活動。任何暴露於公共互聯網的 TeamCity 伺服器在完成安全防護前均應視為高風險。
此事件凸顯針對建構與部署系統的攻擊趨勢持續存在，這些系統因其在軟件開發生命周期中擁有特權存取，已成為高價值攻擊目標。過往其他 CI/CD 工具的漏洞曾引發大規模入侵行動，突顯對此類關鍵系統採取積極補丁管理及嚴格網絡分段的必要性。
使用 TeamCity 的機構需採取結構化回應。應盤點所有實例並確認其版本號，將供應商提供的安全補丁列為緊急優先事項進行排程與套用。透過審核防火牆規則以最小化暴露面、對建構代理及密鑰儲存強制執行最小權限原則，並記錄所有補救措施以符合合規與審計要求，來強化環境安全性。
CVE-2026-63077 再次警示：用於建構與發布軟件的工具本身即為潛在攻擊媒介。防禦這些系統需要結合快速補丁更新、嚴謹的網絡衛生措施及持續監控，以維護軟件供應鏈的完整性。