{"id":241743,"date":"2026-07-29T00:11:58","date_gmt":"2026-07-29T05:11:58","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/07\/critical-teamcity-flaw-could-let-attackers-run-os-commands-without-logging-in"},"modified":"2026-07-29T00:11:58","modified_gmt":"2026-07-29T05:11:58","slug":"critical-teamcity-flaw-could-let-attackers-run-os-commands-without-logging-in","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/07\/critical-teamcity-flaw-could-let-attackers-run-os-commands-without-logging-in","title":{"rendered":"Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/critical-teamcity-flaw-could-let-attackers-run-os-commands-without-logging-in2.jpg\"><\/a><\/p>\n<p>JetBrains is <a href=\"https:\/\/blog.jetbrains.com\/teamcity\/2026\/07\/cve-2026-63077\/\" target=\"_blank\">urging customers<\/a> of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution.<\/p>\n<p>The vulnerability, assigned <strong>CVE-2026\u201363077<\/strong> (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already been updated. JetBrains has credited Antoni Tremblay with discovering and reporting the flaw on July 10, 2026.<\/p>\n<p>\u201cIf exploited, this flaw may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process,\u201d JetBrains said.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026\u201363077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1523,1492],"tags":[],"class_list":["post-241743","post","type-post","status-publish","format-standard","hentry","category-computing","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/241743","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=241743"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/241743\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=241743"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=241743"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=241743"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}