Full Report
JetBrains is warning of a critical authentication bypass vulnerability affecting TeamCity On-Premises that could be exploited to achieve remote code execution. [...]
Analysis Summary
# Vulnerability: Critical Authentication Bypass in TeamCity On-Premises
## CVE Details
- **CVE ID:** CVE-2026-63077
- **CVSS Score:** 9.8 (Critical) - *Estimated based on description*
- **CWE:** CWE-287 (Improper Authentication) / CWE-288 (Authentication Bypass)
## Affected Systems
- **Products:** JetBrains TeamCity On-Premises
- **Versions:** All versions prior to 2025.11.7 and 2026.1.3
- **Configurations:** Systems with HTTPS access enabled for agent polling protocols. (Note: TeamCity Cloud is not affected).
## Vulnerability Description
The flaw exists within the agent polling protocol of TeamCity On-Premises. An attacker with HTTPS access to the server can bypass authentication mechanisms. This bypass allows for the execution of arbitrary operating system commands with the same privileges as the TeamCity server process, leading to Remote Code Execution (RCE).
## Exploitation
- **Status:** Not exploited in the wild (at time of advisory); No PoC mentioned in the article.
- **Complexity:** Low
- **Attack Vector:** Network (HTTPS)
## Impact
- **Confidentiality:** High (Exposure of data, configurations, and stored credentials)
- **Integrity:** High (Potential compromise of build artifacts and CI/CD pipelines)
- **Availability:** High (Full server compromise and command execution)
## Remediation
### Patches
JetBrains recommends upgrading to the following versions:
- **TeamCity 2025.11.7**
- **TeamCity 2026.1.3**
For users unable to perform a full upgrade, a security patch plugin is available for **TeamCity 2017.1 and newer**.
- *Note:* Versions 2017.1 through 2018.1 require a server restart after plugin installation.
### Workarounds
- **Network Segmentation:** Place internet-facing TeamCity servers behind a VPN or additional protective layers.
- **Access Control:** Restrict access to the login page and REST API to authorized internal networks only.
## Detection
- **Indicators of Compromise:** Monitor server logs for unusual agent polling activity or unexpected command execution originating from the TeamCity service account.
- **Detection methods and tools:** Audit CI/CD pipelines for unauthorized changes to build artifacts or configuration settings.
## References
- **JetBrains Advisory:** hxxp[://]blog[.]jetbrains[.]com/teamcity/2026/07/cve-2026-63077/
- **Plugin Installation Guide:** hxxps[://]www[.]jetbrains[.]com/help/teamcity/installing-additional-plugins[.]html#Installing+Plugin+via+Web+UI
- **News Source:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/jetbrains-warns-of-critical-teamcity-remote-code-execution-flaw/