JetBrains Warns TeamCity Users to Patch Critical Security Flaw Without Delay

Organisations using TeamCity have been warned that they should patch a critical security vulnerability immediately, with JetBrains warning that exposed servers could be at risk if administrators delay. The funny thing is, this alert often ties back to source code, build systems, deployment pipelines, and sensitive development credentials.

Also Read TechCrunch Disrupt 2026 Adds Google Presented AI Track With New Industry Focus

Today’s disclosure of a critical security vulnerability in TeamCity could allow malicious actors to gain unauthorised access, run code, steal secrets or interfere with software delivery. The real impact will depend on which versions are affected, the server configuration and whether the instance is accessible from the public internet.

Also Read Nvidia and AMD GPU Kit Prices Expected to Rise Due to New Market Changes

Sensitive Access Can Be Stored on TeamCity Servers

TeamCity is a Continuous Integration & Continuous Deployment server which automates your software builds, testing and deployment.

Also Read iPhone 18 Pro Price Increase Reports Reveal Possible Higher Costs for Buyers

If a TeamCity server is compromised, it can be a juicy target for an attacker due to its connections to code repositories, cloud services, package registries and production environments. Targets can be stored tokens, SSH keys, passwords and build credentials

Also Read Google Uses AI Tools to Detect and Fix Chrome Security Bugs Faster

This makes rapid patching very important for Internet exposed systems .

Security Flaw May Allow Unauthorised Access

The vulnerability is rated as critical because it requires little to no prior authentication for exploitation.

Depending on the vulnerability, an attacker could bypass security controls, create administrative accounts, run commands or access protected project data A successful compromise might also allow the insertion of malicious code in build processes.

“Organisations should not assume their internal systems are secure simply because they are not widely publicised.

Admins Must Patch ASAP

JetBrains is reported to have recommended that users upgrade impacted installations of TeamCity to a patched version as soon as possible.

Administrators should verify their version, read the advisory, and back up any pertinent configuration information before applying the update. Also they need to check the compatibility of plugins and integrations after the upgrade .

If there’s not a patch available yet, restricting network access could help limit exposure, but it is not a replacement for the official fix.

More Exposed Internet-Facing Instances

TeamCity servers that are publicly available on the Internet are more susceptible to automatic scanning and exploitation.

Attackers will often begin scanning for vulnerable systems shortly after a security advisory is issued. Sharing a proof of concept code publicly can help to drive that activity.

When possible, organisations should limit access through firewalls, virtual private networks, allow-lists or zero-trust controls.

check logs for suspicious activityInstalling a patch does not mean that the server was never compromised.

Security teams should look at authentication logs, changes to admin accounts, new user accounts, suspicious build jobs, unexpected plugins, and outbound network connections. They should also look for changes to build scripts, or credentials being used from strange places.

Any unexplained activity should trigger a wider incident response investigation.

Rotate credentials as necessary

If exploitation is suspected then organisations should rotate secrets relating to the TeamCity environment.

These could be repository tokens, cloud credentials, deployment keys, package registry passwords, API keys and service accounts. You may need to make other changes in addition to changing the TeamCity administrator password.

Check previous build artefacts for any indications of tampering.

Sources