Critical Unauthenticated RCE (CVE‑2026‑63077) in JetBrains TeamCity On‑Premises Threatens CI/CD Pipelines
What It Is — JetBrains disclosed a critical remote‑code‑execution flaw (CVE‑2026‑63077) in the TeamCity on‑premises CI/CD server. The vulnerability resides in the agent‑polling protocol and can be triggered without authentication, allowing an attacker to execute OS commands with the privileges of the TeamCity service.
Exploitability — Publicly disclosed; no known active exploitation at time of writing, but a working proof‑of‑concept exists. CVSS ≥ 9.0 (rated Critical by JetBrains).
Affected Products — JetBrains TeamCity On‑Premises (all versions prior to 2025.11.7 / 2026.1.3). The Cloud‑hosted variant is already patched.
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.1 (Change Management) and CC7.1 (System Operations) require documented evidence that critical software patches are applied promptly; an unpatched RCE violates that control.
- Continuous control monitoring must capture patch‑status and configuration drift for CI/CD infrastructure to provide audit‑ready evidence.
- Failure to limit network exposure of CI/CD servers can be cited as a control weakness in the Security principle during SOC 2 examinations.
Recommended Actions
- Upgrade all TeamCity on‑premises instances to 2025.11.7 or 2026.1.3 or apply the official security‑patch plugin for versions 2017.1+.
- Verify patch installation via automated configuration‑management tools and capture the results as immutable audit evidence.
- Restrict inbound network access to the TeamCity server (VPN, IP allow‑list, or zero‑trust segmentation).
- Run the TeamCity service with the minimum OS privileges required for build execution.
- Map the patch‑management activity to SOC 2 controls (CC6.1, CC7.1) in your continuous‑compliance platform.