JetBrains has disclosed a critical authentication bypass vulnerability in TeamCity On-Premises that enables remote attackers to execute arbitrary operating system commands without authentication. The flaw, tracked as CVE-2026-63077, affects all TeamCity On-Premises versions accessible over HTTP(S) and was privately reported by security researcher Antoni Tremblay on 10 July 2026 through the vendor's coordinated disclosure program. No evidence of active exploitation has been detected to date.
The vulnerability allows attackers with HTTP(S) access to bypass authentication checks and execute commands using the privileges assigned to the TeamCity server process. Exploitation occurs through the TeamCity agent polling protocol and requires no credentials, making internet-facing deployments particularly vulnerable. Successful attacks could grant access to TeamCity data, stored credentials, server configurations, and potentially compromise build artifacts and downstream CI/CD pipelines.
JetBrains has released patches in TeamCity On-Premises versions 2025.11.7 and 2026.1.3. Organizations unable to upgrade immediately can deploy a security patch plugin compatible with TeamCity 2017.1 and later versions. For installations running TeamCity 2024.03 or newer, security patch plugins download automatically when update alerts are enabled. Servers running versions 2017.1 to 2018.1 require a restart after plugin installation, while versions 2018.2 and later can enable the plugin without restarting.
TeamCity Cloud customers do not need to take action, as protections have already been implemented in cloud environments. The vendor confirms no evidence of exploitation has been detected in cloud deployments. The security patch plugin addresses only CVE-2026-63077, and JetBrains recommends a full upgrade to benefit from additional security improvements included in the latest releases.
Administrators should prioritize patching internet-facing TeamCity servers immediately. As a long-term security measure, organizations should restrict access to TeamCity On-Premises servers through VPN connections or other protective layers rather than exposing login pages or REST APIs directly to the internet. Additional hardening measures include limiting network access to trusted environments, running TeamCity with minimum required operating system privileges, and deploying servers on dedicated hosts separate from build agents.
Source: https://thecyberexpress.com/cve-2026-63077-teamcity-on-premises/