CVE-2026-63077 is a critical authentication bypass vulnerability in JetBrains TeamCity On-Premises that allows an attacker with HTTPS access to bypass authentication through the agent polling protocol. This flaw enables remote code execution with the privileges of the TeamCity server process. The vulnerability affects all on-premises versions of TeamCity. JetBrains has addressed the issue in versions 2025.11.7 and 2026.1.3 and provides a security patch plugin for versions 2017.1 and later. TeamCity Cloud services are not affected as the vendor has applied mitigations server-side.

Successful exploitation allows an attacker to execute arbitrary operating system commands on the TeamCity server with the same privileges as the server process. This can lead to exposure of sensitive data, configurations, stored credentials, and compromise of build artifacts and CI/CD pipelines. There is no evidence of active exploitation at the time of the advisory, but the vulnerability is critical due to its potential impact and ease of exploitation via HTTPS access.

JetBrains has released official security updates in TeamCity versions 2025.11.7 and 2026.1.3. Customers unable to upgrade can apply a security patch plugin available for TeamCity 2017.1 and later. Versions 2024.03 and newer automatically download and notify administrators of available security patches. Applying these updates or patches is the primary mitigation. Additionally, JetBrains recommends restricting internet-facing TeamCity servers by requiring VPN or other protective layers to reduce exposure. No action is required for TeamCity Cloud customers, as the vendor has already applied necessary protections.