Critical TeamCity RCE Flaw (CVSS 9.8) Lets Hackers Bypass Authentication

JetBrains has disclosed a critical security vulnerability in its on-premises TeamCity CI/CD platform that allows unauthenticated attackers to execute arbitrary operating system commands. Tracked as CVE-2026-63077, the flaw carries a maximum CVSS score of 9.8 and affects all versions of TeamCity On-Premises. The vulnerability was responsibly reported by researcher Antoni Tremblay on July 10, 2026, and has been patched in versions 2025.11.7 and 2026.1.3. TeamCity Cloud instances have already been updated and are not affected.

The flaw resides in the agent polling protocol and enables an attacker with HTTP(S) access to a TeamCity server to bypass authentication checks entirely. Once exploited, the attacker can run arbitrary OS commands under the privileges of the TeamCity server process, potentially exposing sensitive data, stored credentials, build configurations, and server state. Because the attack requires no credentials and can be triggered remotely over standard web protocols, it represents a severe risk for any organization exposing a TeamCity instance to the internet. Administrators can quickly assess their external attack surface with a port scanner and verify TLS configuration using an SSL/TLS checker.

In addition to the patched releases, JetBrains has published a security patch plugin compatible with TeamCity versions 2017.1 and later for customers who cannot immediately upgrade. The vendor stressed that the plugin only addresses CVE-2026-63077 and recommended upgrading to the latest release to benefit from additional security improvements. There is currently no evidence of in-the-wild exploitation, though the high CVSS score and the public availability of detailed technical information mean threat actors are likely to develop weaponized exploits quickly.

To reduce exposure, JetBrains advised organizations to place TeamCity behind a VPN, enforce multi-factor authentication, and avoid exposing the login screen or REST API to the public internet. Security teams should also audit stored credentials, rotate any secrets that may have been accessible to the server process, and run a privacy checkup to ensure that no other internal services are similarly exposed. With CI/CD servers increasingly targeted by ransomware crews and APT groups, prompt patching of this critical authentication bypass should be treated as a top priority.