CVE-2026-63077 — a critical authentication bypass in TeamCity On-Premises — can be exploited by an attacker with HTTPS access to a TeamCity server to execute arbitrary operating-system commands with the privileges of the server process.
CVE-2026-63077: authentication bypass via the agent polling protocol
JetBrains published an advisory on July 27 warning that CVE-2026-63077 allows an unauthenticated actor to bypass TeamCity authentication by abusing the agent polling protocol. The vendor says an attacker who can reach the TeamCity server over HTTPS may leverage the flaw to run arbitrary commands as the account used by the TeamCity server process.
The advisory frames the risk concretely: “All versions of TeamCity On-Premises are affected,” JetBrains states, while noting that “TeamCity Cloud customers are not required to take any action, as the necessary measures have already been applied.”
Who and what is affected
TeamCity is a commercial continuous integration and continuous delivery (CI/CD) server used to build, test, and deploy software. JetBrains warns that, depending on privileges, “successful exploitation of CVE-2026-63077 could expose TeamCity data, configurations, stored credentials, or compromise build artifacts and CI/CD pipelines,” Daniel Gallo, Solutions Engineering Lead at JetBrains, said in the advisory.
At the time the advisory was published on July 27 there was no evidence of active exploitation, JetBrains added. Still, the vendor pointed to a track record of TeamCity flaws being leveraged in the past — “including by ransomware gangs and state-backed actors” — as a reason administrators should act quickly.
Patch and mitigation options
- JetBrains lists upgrading as the primary remediation: the issue is fixed in TeamCity versions 2025.11.7 and 2026.1.3.
- For environments that cannot upgrade, JetBrains is offering a security patch as a plugin for TeamCity 2017.1 and newer.
- TeamCity 2024.03 and newer will automatically download available security patch plugins and notify administrators so they can install them.
- Administrators running TeamCity versions 2017.1 through 2018.1 should note that the security-update plugin will require a server restart for the fix to take effect.
JetBrains says detailed instructions for installing the security plugin are available in its advisory and related documentation.
Operational protections JetBrains recommends
Beyond patching, JetBrains highlighted several operational controls. The vendor recommends placing internet-facing TeamCity servers behind protective layers such as VPNs, and cautioned that simply exposing the login page or REST API can provide an attack path for newly disclosed vulnerabilities.
Those recommendations echo a basic containment model: reduce remote exposure and make it harder for unauthenticated HTTPS access to reach the agent polling endpoints that this CVE abuses.
What this means for CI/CD administrators, procurement leaders, and security teams
CI/CD administrators should prioritize inventory and remediation: confirm whether on-premises TeamCity instances are running and, if so, schedule upgrades to 2025.11.7 or 2026.1.3 or apply the provided plugin for supported older releases. Note the restart requirement for TeamCity 2017.1–2018.1 after plugin installation.
Procurement and platform owners who manage hosted or cloud CI services should verify whether their vendors are TeamCity Cloud customers; JetBrains explicitly states those customers “are not required to take any action, as the necessary measures have already been applied.”
Security operations teams should treat exposed TeamCity endpoints as high-risk following this advisory. The source material also includes a detection-related data point: “Security teams log 54% of successful attacks and alert on just 14%,” and recommends using breach-and-attack simulation to validate SIEM and EDR rules so threats do not slip by unseen.
JetBrains says the flaw was privately reported on July 10 and fixed in the listed releases. Given prior misuse of TeamCity vulnerabilities by criminal and state-backed actors, the vendor’s combined advice is straightforward: apply the official updates or plugin, reduce internet exposure of TeamCity endpoints, and follow the documented installation steps to ensure the server-side fix takes effect.
Read the original advisory and installation instructions on BleepingComputer: https://www.bleepingcomputer.com/news/security/jetbrains-warns-of-critical-teamcity-remote-code-execution-flaw/