**JetBrains** has issued a stark warning regarding a critical authentication bypass vulnerability impacting its **TeamCity On-Premises** continuous integration and continuous delivery (CI/CD) server. The flaw, identified as **CVE-2026-63077**, presents a significant risk for remote code execution. ### The Vulnerability Explained **CVE-2026-63077** allows an attacker with HTTPS access to a **TeamCity** server to bypass authentication protocols via the agent polling mechanism. This bypass enables the execution of arbitrary operating system commands with the same privileges as the server process. **JetBrains** confirmed in its advisory that "All versions of **TeamCity On-Premises** are affected." However, **TeamCity Cloud** customers are not required to take any action, as the necessary mitigations have already been applied to their environments. **TeamCity** is a widely used commercial CI/CD server, crucial for building, testing, and deploying software. The potential impact of a successful exploit is severe. ### Potential Impact and Past Exploitation **Daniel Gallo**, Solutions Engineering Lead at **JetBrains**, highlighted the serious consequences of **CVE-2026-63077** exploitation. Depending on the server's privileges, attackers could gain access to **TeamCity** data, configurations, stored credentials, or compromise build artifacts and entire CI/CD pipelines. While there was no evidence of active exploitation at the time the advisory was published on July 27, the history of **TeamCity** vulnerabilities is a cause for concern. Past flaws in **TeamCity** have been extensively leveraged by various threat actors, including ransomware gangs and state-backed groups, to breach networks and create administrative accounts. Given this history, administrators are strongly urged to take immediate action to mitigate the risks associated with **CVE-2026-63077**. ### Recommended Mitigation Actions **JetBrains** received a private report of the issue on July 10 and promptly addressed it in **TeamCity** versions 2025.11.7 and 2026.1.3. The primary recommendation is to upgrade to these latest versions. For organizations unable to immediately upgrade, a security patch is available as a plugin for **TeamCity** versions 2017.1 and newer. Notably, **TeamCity** versions 2024.03 and newer automatically download available security patch plugins and notify administrators for installation. Users of **TeamCity** versions 2017.1 through 2018.1 will need to perform a server restart after installing the patch plugin for the security updates to take effect. Detailed instructions for installing the security plugin are available on the **JetBrains** documentation site. Beyond patching, **JetBrains** also reiterated general best practices for securing **TeamCity** servers. These include implementing VPN access or other protective layers for any internet-facing **TeamCity** instances. The vendor emphasized that even exposing the login page or REST API can provide an entry point for attackers to exploit newly disclosed vulnerabilities.