{"id":832969,"date":"2026-07-30T07:31:10","date_gmt":"2026-07-30T07:31:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/832969\/"},"modified":"2026-07-30T07:31:10","modified_gmt":"2026-07-30T07:31:10","slug":"update-now-jetbrains-warns-of-critical-rce-vulnerability-in-its-teamcity-on-premises-platform","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/832969\/","title":{"rendered":"Update now! JetBrains warns of critical RCE vulnerability in its TeamCity On-Premises platform"},"content":{"rendered":"<p>Software developer JetBrains has disclosed CVE-2026-63077 and advises all customers to update to the latest version or apply a security patch.<\/p>\n<p>                                            &#13;<\/p>\n<p>The development team behind a popular self-hosted continuous integration and continuous delivery server warned its customers to take urgent action after it disclosed a near-perfect-10 critical remote code execution (RCE) vulnerability in one of its platforms.<\/p>\n<p>&#13;<\/p>\n<p>In a 28 July blog post, JetBrains disclosed <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-63077\" target=\"_blank\" rel=\"noopener nofollow\">CVE-2026-63077<\/a> (which has a CVSS score of 9.8), impacting its TeamCity On-Premises platform, <a href=\"https:\/\/blog.jetbrains.com\/teamcity\/2026\/07\/cve-2026-63077\/\" target=\"_blank\" rel=\"noopener nofollow\">saying that if it were to be exploited<\/a>, it \u201cmay allow an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands\u201d.<\/p>\n<p>\n        You\u2019re out of free articles for this month    <\/p>\n<p>&#13;<\/p>\n<p>\u201cAll versions of TeamCity On-Premises are affected. TeamCity Cloud customers are not required to take any action, as the necessary measures have already been applied,\u201d TeamCity solutions engineer Daniel Gallo said.<\/p>\n<p>&#13;<\/p>\n<p>\u201cWe have verified that there is no evidence of TeamCity Cloud environments being exploited through this vulnerability.\u201d<\/p>\n<p>&#13;<\/p>\n<p>A fix has been introduced in versions 2025.11.7 and 2026.1.3, while a security patch plug-in has also been released for versions 2017.1 and later. The patch, however, only addresses that specific vulnerability, and JetBrains recommends an upgrade to take advantage of other security updates.<\/p>\n<p>&#13;<\/p>\n<p>Cyber security firm Rapid7 agrees with JetBrains\u2019 advice to make updating a priority.<\/p>\n<p>&#13;<\/p>\n<p>\u201cOrganisations running TeamCity On-Premises should urgently prioritise updating to a fixed version, either via the TeamCity UI update workflow or by downloading and installing one of the following fixed versions,\u201d <a href=\"https:\/\/www.rapid7.com\/blog\/post\/etr-cve-2026-63077-critical-unauthenticated-remote-code-execution-in-jetbrains-teamcity\/\" target=\"_blank\" rel=\"noopener nofollow\">the company said in a 29 July blog post<\/a>.<\/p>\n<p>&#13;<\/p>\n<p>\u201cIn addition to patching, as a defence-in-depth measure, Rapid7 recommends restricting network access to TeamCity servers to only users and systems that must have it.\u201d<\/p>\n<p>&#13;<\/p>\n<p>The vulnerability was reported to JetBrains by security researcher Antoni Tremblay on 10 July.<\/p>\n<p><a href=\"https:\/\/www.google.com\/preferences\/source?q=https:\/\/www.cyberdaily.au\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" style=\"flex-shrink:0;margin-bottom: 0\"><img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/05\/google_preferred_source_badge_dark_2x_novto2.png\" alt=\"Cyber Daily\" style=\"width:200px;display:block;\"\/><\/a>Want to see more stories from trusted news sources?<br \/>Make Cyber Daily a preferred news source on Google.<\/p>\n<p>                                <a class=\"flex items-center justify-center no-underline h-full w-full hover:opacity-75\" href=\"https:\/\/www.cyberdaily.au\/authors\/david-hollingworth\" title=\"View all articles from David Hollingworth\" rel=\"nofollow noopener\" target=\"_blank\"><br \/>\n                    <img class=\"h-full w-full object-cover author-img\" src=\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/07\/david-hollingworth_sb8om1.jpg\" alt=\"David Hollingworth\" width=\"140\" height=\"140\" loading=\"lazy\" decoding=\"async\"\/><br \/>\n                <\/a><\/p>\n<p>                            <a class=\"inline-block text-[#55b0c2] text-lg font-bold hover:opacity-80 transition-opacity underline\" href=\"https:\/\/www.cyberdaily.au\/authors\/david-hollingworth\" title=\"About View all articles from David Hollingworth\" rel=\"nofollow noopener\" target=\"_blank\"><br \/>\n                        David Hollingworth                            <\/a><\/p>\n<p>David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.<\/p>\n","protected":false},"excerpt":{"rendered":"Software developer JetBrains has disclosed CVE-2026-63077 and advises all customers to update to the latest version or apply&hellip;\n","protected":false},"author":2,"featured_media":832970,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[64,63,105],"class_list":["post-832969","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-au","tag-australia","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/832969","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=832969"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/832969\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/832970"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=832969"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=832969"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=832969"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}