Critical Vulnerability in JetBrains TeamCity Allows Unauthenticated Remote Code Execution
JetBrains has addressed a critical vulnerability in its TeamCity CI/CD server that enables unauthenticated remote code execution on affected on-premises installations.
The flaw, identified as CVE-2026-63077, resides in the product’s agent polling protocol. Attackers who can reach the TeamCity Server over HTTP or HTTPS can bypass authentication checks and execute arbitrary operating-system commands.
Depending on the privileges assigned to the server process, successful exploitation may result in leakage of stored data, configuration files, and credentials. Attackers could also alter server state or undermine the integrity of build artifacts and downstream CI/CD pipelines.
The vulnerability received a CVSSv3.1 base score of 9.8 and was rated Critical, the highest severity level. At the time the advisory was published, no exploitation attempts had been observed in the wild.
JetBrains released patched versions TeamCity 2026.1.3 and TeamCity 2025.11.7. A patch plugin is also available for all supported releases from TeamCity 2017.1 onward. Organizations unable to apply updates immediately are advised to restrict external network access to the server as a temporary mitigation.
Related articles
Critical OS Command Injection Flaw in Arista VeloCloud Orchestrator Exploited in the Wild
Arista Networks has disclosed a critical vulnerability in the on-premises version of its VeloCloud Orchestrator product used for centralized SD-WAN management. The flaw, tracked as CVE-2026-16812, is an OS command injection issue that allows remote attackers to compromise the system without any authentication. Exploitation has already been confirmed, and the vulnerability carries the maximum CVSS base score of 10.0 in both version 4.0 and 3.1, classifying it as Critical. Successful attacks can impact the confidentiality, integrity, and availability of the orchestrator and all managed data. In addition, a compromised VeloCloud Orchestrator instance may grant attackers access to connected VeloCloud Edge devices across the network.
CISA Adds Exploited Flaws in FortiOS and VeloCloud Orchestrator to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-16812 affects the on-premises version of Arista VeloCloud Orchestrator and allows OS command injection that can lead to data leakage, tampering, and denial of service. The flaw carries a maximum CVSS v3.1 base score of 10.0 and is rated Critical. CVE-2025-68686 impacts Fortinet FortiOS and can be used to bypass specific patches and steal sensitive information when combined with another vulnerability that grants prior filesystem access. Federal agencies must remediate the VeloCloud issue by July 30 and the FortiOS issue by August 10.
Critical Vulnerabilities in JetBrains IntelliJ IDEA and TeamCity Enable Remote Code Execution
JetBrains has addressed multiple critical vulnerabilities in its IntelliJ IDEA and TeamCity products that could allow remote code execution, unauthorized file access, and sandbox escapes. The flaws affect remote development environments and require immediate patching, especially in shared setups. In IntelliJ IDEA, CVE-2026-59792 involves directory traversal during workspace identifier processing and carries a CVSS score of up to 9.8. TeamCity received fixes for several issues, including malicious Git repository configurations that enable code execution and a Kotlin DSL sandbox escape. Additional patches cover arbitrary file access through Perforce integration and a persistent cross-site scripting flaw on cloud profile pages. Administrators are urged to update IntelliJ IDEA to versions 2026.1.4 or 2026.2 and TeamCity to 2026.1.2 or 2025.11.6 depending on the release line in use.
Critical Vulnerabilities Patched in OpenAM with Release of Version 16.1.2
Multiple serious vulnerabilities have been disclosed in OpenAM, including remote code execution flaws that require no authentication. The Open Identity Platform development team released OpenAM 16.1.2 on July 20, 2026, addressing a total of 18 issues that encompass both native vulnerabilities and those in third-party dependencies. CVE-2026-62379 allows arbitrary Java classes specified in XML to be loaded and instantiated without validation, enabling unauthenticated remote code execution. CVE-2026-62263 stems from improper deserialization filtering in Java, similarly permitting unauthenticated code execution. The update also resolves an XSS vulnerability (CVE-2026-62280) on the authorization consent page and fixes issues in components such as Node.js, js-yaml, and websocket-driver. CVSS scores rate the two primary flaws as critical at 9.8 and 9.2 respectively.