JetBrains has issued an urgent warning regarding a critical authentication bypass vulnerability in TeamCity On-Premises that could allow attackers to execute remote commands.

Key Takeaways

  • Vulnerability tracked as CVE-2026-63077 allows authentication bypass.
  • All TeamCity On-Premises versions are affected.
  • Attackers can execute arbitrary OS commands via the agent polling protocol.
  • Immediate updates to versions 2025.11.7 or 2026.1.3 are recommended.

Software giant JetBrains has issued a high-priority security advisory regarding a critical authentication bypass vulnerability affecting TeamCity On-Premises. This flaw could potentially be exploited to achieve Remote Code Execution (RCE), granting attackers significant control over affected systems.

The security flaw, identified as CVE-2026-63077, allows an attacker with HTTPS access to a TeamCity server to bypass authentication through the agent polling protocol. Once bypassed, the attacker can execute arbitrary operating system commands with the same privileges as the server process.

Why This Matters

BozokMedia analysis shows that vulnerabilities in Continuous Integration and Continuous Delivery (CI/CD) tools are high-value targets for sophisticated threat actors. According to Daniel Gallo, Solutions Engineering Lead at JetBrains, successful exploitation could compromise sensitive TeamCity data, configurations, stored credentials, and even critical build artifacts or CI/CD pipelines.

A breach in the CI/CD pipeline represents a systemic risk to the entire software supply chain.

Historical Context

Historically, flaws in TeamCity have been extensively leveraged by ransomware gangs and state-backed actors to infiltrate corporate environments. This pattern underscores the necessity for rapid patching and robust perimeter security, such as utilizing VPNs for internet-facing servers.

Mitigation and Recommendations

JetBrains advises all administrators to upgrade to TeamCity versions 2025.11.7 or 2026.1.3 immediately. For those unable to perform a full upgrade, a security patch is available as a plugin for versions 2017.1 and above. Note that versions 2017.1 through 2018.1 require a server restart to apply the security updates.

Did You Know?: Security teams typically alert on just 14% of successful attacks, while 54% are logged but potentially missed during the initial breach.

Frequently Asked Questions

1. Are TeamCity Cloud users at risk?
No, TeamCity Cloud customers are not required to take action as the necessary security measures have already been applied.

2. What is the best way to protect my server?
Beyond patching, JetBrains recommends implementing protective layers like VPN access for any TeamCity servers exposed to the internet.