JetBrains warns of critical TeamCity remote code execution flaw

Key Points:

• JetBrains has disclosed a critical authentication bypass vulnerability (CVE-2026-63077) in all versions of TeamCity On-Premises that allows attackers with HTTPS access to execute arbitrary OS commands on the server.
• The flaw exploits the agent polling protocol to bypass authentication, potentially compromising data, credentials, build artifacts, and CI/CD pipelines depending on the attacker's privileges.
• No active exploitation has been detected as of the advisory date (July 27), but given past abuse of TeamCity vulnerabilities by ransomware and state actors, immediate mitigation is advised.
• JetBrains recommends upgrading to TeamCity versions 2025.11.7 or 2026.1.3, or applying a security patch plugin available for versions 2017.1 and later; newer versions automatically notify admins of available patches.
• Additional best practices include restricting internet-facing TeamCity servers behind VPNs or protective layers, as even login pages or REST APIs can serve as attack vectors.