JetBrains is warning of a critical authentication bypass vulnerability affecting TeamCity On-Premises that could be exploited to achieve remote code execution.
The security issue is tracked as CVE-2026-63077 and can be leveraged by an attacker with HTTPS access to a TeamCity server to bypass authentication via the agent polling protocol and execute arbitrary operating system commands with the privileges of the server process.
“All versions of TeamCity On-Premises are affected,” JetBrains warns in the advisory, adding that “TeamCity Cloud customers are not required to take any action, as the necessary measures have already been applied.”
TeamCity is a commercial continuous integration and continuous delivery (CI/CD) server that is used for building, testing, and deploying software.
Daniel Gallo, Solutions Engineering Lead at JetBrains, says that successful exploitation of CVE-2026-63077 could expose TeamCity data, configurations, stored credentials, or compromise build artifacts and CI/CD pipelines, depending on privileges.
At the time the advisory was published on July 27, there was no evidence of active exploitation.
Given that TeamCity flaws have been extensively leveraged in the past, including by ransomware gangs and state-backed actors, administrators should take immediate action to mitigate the risks.
Recommended actions
JetBrains says the issue was privately reported to them on July 10 and was addressed in TeamCity versions 2025.11.7 and 2026.1.3. The vendor recommends upgrading to the versions listed above as the first option.
A security patch is available for TeamCity 2017.1+ as a plugin for customers unable to upgrade to the latest releases.
JetBrains notes that TeamCity 2024.03 and newer automatically downloads available security patch plugins and notifies administrators so they can install them.
Also, TeamCity versions 2017.1 through 2018.1 will require a server restart for the security updates to take effect after installing the patch plugin.
Detailed instructions for installing the security plugin are available here.
JetBrains also highlighted a set of more generic “best practices,” including requiring VPN access or other protective layers on internet-facing TeamCity servers.
The vendor reminds that even exposing the login page or REST API can give attackers an entry point to exploit newly disclosed vulnerabilities.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
