JetBrains has released emergency patches for a critical vulnerability in TeamCity On-Premises that allows an unauthenticated attacker with HTTP or HTTPS access to bypass all authentication checks and execute arbitrary operating system commands. The flaw, CVE-2026-63077, carries a CVSS score of 9.8 and affects every on-premises release of TeamCity. It was discovered by security researcher Antoni Tremblay and disclosed to JetBrains on July 10, 2026. TeamCity Cloud instances were patched on JetBrains’s end; the risk falls on the far larger population of self-hosted deployments.
The vulnerability lives in the agent polling protocol — the channel TeamCity uses to communicate with build agents. An attacker can abuse this path to sidestep login enforcement entirely and reach code execution under the permissions of the TeamCity server process. Depending on how the server is configured, that can mean reading stored build secrets, source credentials, environment variables, and other sensitive data, or directly modifying server state. JetBrains has released fixed versions 2025.11.7 and 2026.1.3, and also published a security patch plugin for deployments still on older releases back to version 2017.1 for teams that cannot upgrade immediately.
How to check if you’re affected
Affected versions include all TeamCity On-Premises releases prior to 2025.11.7 and 2026.1.3 (CVE-2026-63077). Run Help → About in the TeamCity web UI to confirm the installed version. Upgrade to one of the patched versions, or install the security patch plugin for older 2017.1+ installs. If immediate patching is not possible, restrict network access to the TeamCity server to trusted IP ranges or require a VPN — JetBrains specifically notes that even exposing the login page over the internet gives attackers an entry point for newly disclosed vulnerabilities like this one.