Every on-premises TeamCity server is vulnerable to an auth bypass in the agent polling protocol

JetBrains published an advisory on July 27, 2026 for CVE-2026-63077, an authentication bypass affecting every version of TeamCity On-Premises (TeamCity Cloud is unaffected). The flaw abuses the agent polling protocol, the channel build agents use to check in with the server, to skip authentication on HTTPS-accessible servers, and once bypassed, an attacker can execute arbitrary operating system commands with the privileges of the TeamCity server process itself, a direct path to remote code execution with no login required. The bug was privately reported on July 10 and fixed 17 days later in TeamCity 2025.11.7 and 2026.1.3; a security patch plugin covers versions back to 2017.1 for teams that can't upgrade immediately, and installations on 2024.03 or later auto-download the patch. No active exploitation was confirmed at publication, but JetBrains flagged TeamCity's history as a favored ransomware and state-actor target as reason for urgency regardless.

Why it matters

A CI/CD server holds the credentials and access needed to build and ship your software, so an unauthenticated RCE there isn't just one compromised host, it's a potential software supply chain foothold into everything the pipeline touches. TeamCity specifically has a track record of exactly this outcome: prior TeamCity auth bypasses have been used for both ransomware deployment and nation-state supply-chain operations.

If you run TeamCity On-Premises, patch regardless of whether auto-download applies to your version, and don't treat "no confirmed exploitation yet" as a reason to wait, given how quickly this class of bug tends to get weaponized once public.

Source: BleepingComputer