JetBrains has issued an emergency advisory for CVE-2026-63077, a critical authentication bypass in TeamCity On-Premises that allows any attacker who can reach the server over HTTPS to skip the login entirely and execute arbitrary operating system commands with the privileges of the server process. The flaw lives in the agent polling protocol — the channel TeamCity build agents use to check in with the server — and does not require a valid account to exploit.
Every version of TeamCity On-Premises is affected. JetBrains fixed the issue in TeamCity 2025.11.7 and 2026.1.3, and also released a security patch plugin for customers running version 2017.1 or later who cannot upgrade immediately. TeamCity Cloud was patched silently and requires no customer action. The vulnerability was reported privately on July 10 and no active exploitation had been observed as of JetBrains’ July 27 advisory — but TeamCity servers have been heavily targeted in the past by ransomware gangs and nation-state actors, so the window before weaponised exploits appear is likely short.
How to check if you’re affected
Affected versions include all TeamCity On-Premises releases prior to 2025.11.7 and 2026.1.3. Cloud-hosted TeamCity instances are not affected. To check your version, log in to your TeamCity server and look at the version string in the administration panel or the server’s About page. If you are on-premises and not yet on one of the fixed versions, apply the upgrade or install the patch plugin immediately. JetBrains also recommends placing TeamCity servers behind a VPN or other access-control layer so that only authorised hosts can reach the server’s HTTPS port.