Critical RCE in JetBrains TeamCity (CVE‑2026‑63077) Enables Unlogged OS Command Execution
What It Is — JetBrains disclosed a critical remote code execution flaw (CVE‑2026‑63077) in TeamCity on‑premises editions. An attacker who can supply a crafted request can execute arbitrary OS commands on the build server without authentication or logging.
Exploitability — CVSS 9.8 (Critical). Public advisory; proof‑of‑concept code has been released, and active exploitation is being tracked by security researchers.
Affected Products — All on‑premises versions of JetBrains TeamCity prior to 2025.11.7 and 2026.1.3. Cloud‑hosted TeamCity instances are not affected.
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.2 – Vulnerability Management: The flaw underscores the need for documented, continuous vulnerability scanning and rapid patch deployment to satisfy the “identified vulnerabilities are remediated in a timely manner” control.
- SOC 2 CC6.1 – Change Management: Evidence of a formal change‑control process (approval, testing, rollback) is required to prove that the patch was applied without disrupting CI pipelines.
- SOC 2 CC7.1 – System Operations & Monitoring: Because the exploit bypasses logging, organizations must demonstrate supplemental monitoring (e.g., host‑based IDS, immutable audit logs) to detect anomalous command execution.
Recommended Actions
- Patch Immediately – Upgrade all on‑premises TeamCity servers to 2025.11.7 or later (2026.1.3).
- Validate Patch Deployment – Run an automated inventory scan to confirm version compliance across all environments.
- Update Vulnerability Management Controls – Record the CVE in your vulnerability register, assign remediation owners, and capture evidence of patch testing and deployment for audit.
- Enhance Logging – Deploy host‑level monitoring that records command‑line activity and integrates with your SIEM to cover the logging gap.
Source: The Hacker News