GoKawiilJetBrains is warning of a critical authentication bypass vulnerability affecting TeamCity On-Premises that could be exploited to achieve remote code execution.
The security issue is tracked as CVE-2026-63077 and can be leveraged by an attacker with HTTPS access to a TeamCity server to bypass authentication via the agent polling protocol and execute arbitrary operating system commands with the privileges of the server process.
“All versions of TeamCity On-Premises are affected,” JetBrains warns in the advisory, adding that “TeamCity Cloud customers are not required to take any action, as the necessary measures have already been applied.”
TeamCity is a commercial continuous integration and continuous delivery (CI/CD) server that is used for building, testing, and deploying software.
Daniel Gallo, Solutions Engineering Lead at JetBrains, says that successful exploitation of CVE-2026-63077 could expose TeamCity data, configurations, stored credentials, or compromise build artifacts and CI/CD pipelines, depending on privileges.
At the time the advisory was published on July 27, there was no evidence of active exploitation.
Given that TeamCity flaws have been extensively leveraged in the past, including by ransomware gangs and state-backed actors, administrators should take immediate action to mitigate the risks.
Recommended actions
JetBrains says the issue was privately reported to them on July 10 and was addressed in TeamCity versions 2025.11.7 and 2026.1.3. The vendor recommends upgrading to the versions listed above as the first option.
A security patch is available for TeamCity 2017.1+ as a plugin for customers unable to upgrade to the latest releases.
... continue reading