Critical RCE in JetBrains TeamCity (CVE‑2026‑63077) Allows Unauthenticated Command Execution
What It Is — JetBrains disclosed CVE‑2026‑63077, a remote‑code‑execution flaw in TeamCity Server that can be triggered without authentication. An attacker can send a crafted HTTP request that results in arbitrary OS‑level command execution on the CI/CD host.
Exploitability — The vulnerability is rated Critical (CVSS 9.8). Proof‑of‑concept code has been published, and active exploitation is being tracked by several threat intel feeds.
Affected Products — JetBrains TeamCity 2022.10.3 and earlier releases (on‑premises and self‑hosted cloud instances). JetBrains has released a patch; users must upgrade to 2022.10.4 or later.
Why It Matters for Compliance & Audit Readiness
- SOC 2 Access Controls – Unauthenticated RCE bypasses logical access safeguards, directly violating CC6.1 (System Operations) and CC7.1 (Change Management) requirements for protecting production environments.
- Continuous Control Monitoring – Detecting unauthorized command execution requires real‑time logging and alerting; without it, organizations lack defensible audit evidence of “least‑privilege” enforcement.
- Supply‑Chain Trust – CI/CD pipelines are a high‑value attack surface; a breach here can cascade to downstream services, jeopardizing the integrity of the entire software delivery lifecycle that auditors scrutinize.
Recommended Actions
- Patch Immediately – Upgrade all TeamCity servers to version 2022.10.4 or later.
- Validate Post‑Patch – Run the JetBrains verification script or manually test for the CVE‑2026‑63077 exploit vector.
- Enforce Strict Access Controls – Restrict network access to the TeamCity web UI to trusted IP ranges and enforce MFA for all administrative accounts.
- Enable Comprehensive Logging – Capture full request/response logs, command‑execution events, and forward them to a SIEM for continuous monitoring.
- Map to SOC 2 Controls – Document the remediation in your SOC 2 evidence repository, linking the patch to CC6.1 and CC7.1 controls.