# Every on-premises TeamCity server is vulnerable to an auth bypass in the agent polling protocol

Source: https://startwithidentity.com/blog/2026-07-27-jetbrains-teamcity-authentication-bypass-rce/
Last updated: 2026-08-06
License: content by Start with Identity. Cite the source URL.

---

JetBrains published an advisory on July 27, 2026 for [CVE-2026-63077](https://startwithidentity.com/cves/cve-2026-63077/), an authentication bypass affecting every version of TeamCity On-Premises (TeamCity Cloud is unaffected). The flaw abuses the agent polling protocol, the channel build agents use to check in with the server, to skip authentication on HTTPS-accessible servers, and once bypassed, an attacker can execute arbitrary operating system commands with the privileges of the TeamCity server process itself, a direct path to remote code execution with no login required. The bug was privately reported on July 10 and fixed 17 days later in TeamCity 2025.11.7 and 2026.1.3; a security patch plugin covers versions back to 2017.1 for teams that can't upgrade immediately, and installations on 2024.03 or later auto-download the patch. No active exploitation was confirmed at publication, but JetBrains flagged TeamCity's history as a favored ransomware and state-actor target as reason for urgency regardless.

## Why it matters

A CI/CD server holds the credentials and access needed to build and ship your software, so an unauthenticated RCE there isn't just one compromised host, it's a potential [software supply chain](https://startwithidentity.com/glossary/secrets-rotation/) foothold into everything the pipeline touches. TeamCity specifically has a track record of exactly this outcome: [CVE-2023-42793](https://startwithidentity.com/cves/cve-2023-42793/) and [CVE-2024-27198](https://startwithidentity.com/cves/cve-2024-27198/) were both CISA KEV authentication bypasses used for ransomware and nation-state supply-chain operations.

If you run TeamCity On-Premises, patch regardless of whether auto-download applies to your version, and don't treat "no confirmed exploitation yet" as a reason to wait, given how quickly this class of bug tends to get weaponized once public.

Source: [BleepingComputer](https://www.bleepingcomputer.com/news/security/jetbrains-warns-of-critical-teamcity-remote-code-execution-flaw/)