A critical vulnerability has been discovered in TeamCity, a popular continuous integration and delivery (CI/CD) server used by thousands of organizations worldwide. JetBrains, the vendor behind TeamCity, is warning that an attacker with HTTPS access to a TeamCity server can exploit the flaw to bypass authentication and execute arbitrary operating system commands with the privileges of the server process.
The vulnerability, tracked as CVE-2026-63077, affects all versions of TeamCity On-Premises. This means that any organization using the on-premises version of TeamCity is at risk, regardless of whether they have applied patches or updates recently. Fortunately, JetBrains has already addressed the issue in newer versions of TeamCity, specifically 2025.11.7 and 2026.1.3.
The vulnerability works by allowing an attacker to bypass authentication via the agent polling protocol, which is used for communication between TeamCity servers and agents. This can be done remotely, using only HTTPS access to the server. Once authenticated, the attacker could potentially expose sensitive data, configurations, stored credentials, or even compromise build artifacts and CI/CD pipelines.
It’s worth noting that there has been no evidence of active exploitation of this vulnerability at the time of writing. However, given the severity of the flaw and its potential impact on TeamCity users, administrators should take immediate action to mitigate the risks. As a matter of fact, JetBrains warns that successful exploitation could lead to devastating consequences, including data breaches and ransomware attacks.
To address the issue, JetBrains recommends upgrading to the latest versions of TeamCity (2025.11.7 or 2026.1.3) as soon as possible. For customers unable to upgrade immediately, a security patch is available as a plugin for TeamCity 2017.1+. Additionally, TeamCity 2024.03 and newer will automatically download and install available security patch plugins.
It’s also essential to follow best practices when running TeamCity servers, such as requiring VPN access or other protective layers on internet-facing servers. This can help prevent attackers from exploiting newly disclosed vulnerabilities like CVE-2026-63077.
In conclusion, the discovery of this critical vulnerability in TeamCity serves as a reminder that cybersecurity is an ongoing process that requires constant attention and vigilance. By staying up-to-date with the latest security patches and following best practices, organizations can reduce their risk of being compromised by such vulnerabilities.
Source: Bleeping Computer — 2026-07-30