Every on-premises TeamCity server is vulnerable to an auth bypass in the agent polling protocol
CVE-2026-63077 lets an unauthenticated attacker abuse TeamCity's agent polling protocol to bypass authentication and run arbitrary OS commands with the server process's privileges, on every version of TeamCity On-Premises.
JetBrains published an advisory on July 27, 2026 for CVE-2026-63077, an authentication bypass affecting every version of TeamCity On-Premises (TeamCity Cloud is unaffected). The flaw abuses the agent polling protocol, the channel build agents use to check in with the server, to skip authentication on HTTPS-accessible servers, and once bypassed, an attacker can execute arbitrary operating system commands with the privileges of the TeamCity server process itself, a direct path to remote code execution with no login required. The bug was privately reported on July 10 and fixed 17 days later in TeamCity 2025.11.7 and 2026.1.3; a security patch plugin covers versions back to 2017.1 for teams that can't upgrade immediately, and installations on 2024.03 or later auto-download the patch. No active exploitation was confirmed at publication, but JetBrains flagged TeamCity's history as a favored ransomware and state-actor target as reason for urgency regardless.
Why it matters
A CI/CD server holds the credentials and access needed to build and ship your software, so an unauthenticated RCE there isn't just one compromised host, it's a potential software supply chain foothold into everything the pipeline touches. TeamCity specifically has a track record of exactly this outcome: CVE-2023-42793 and CVE-2024-27198 were both CISA KEV authentication bypasses used for ransomware and nation-state supply-chain operations.
If you run TeamCity On-Premises, patch regardless of whether auto-download applies to your version, and don't treat "no confirmed exploitation yet" as a reason to wait, given how quickly this class of bug tends to get weaponized once public.
Source: BleepingComputer
Related on Start with Identity
- BlogN-able confirms attackers used an N-central auth bypass to reach managed customer networks
CVE-2026-18577 gave unauthenticated attackers full administrative control of N-central, which they used through the Take Control feature to reach downstream man
- BlogN-able's first fix for an N-central auth bypass missed a second exploitation path
Attackers used an authentication bypass in N-able's N-central RMM platform to gain administrative access and register persistent Cloudflare tunnels on managed e
- BlogQilin ransomware affiliates are using a patched PAN-OS auth bypass as their front door
Arctic Wolf Labs traced multiple June 2026 Qilin ransomware intrusions to a patched Palo Alto Networks PAN-OS flaw that lets attackers establish a VPN session w
- CVEConnectWise ScreenConnect auth bypass via an alternate path
ScreenConnect 23.9.7 and earlier skipped authentication on an alternate setup path (CWE-288). Attackers created admin users within hours. CISA KEV. CVSS 10.0. P
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEFortiWeb auth bypass and path traversal, admin creation
FortiWeb authentication bypass plus path traversal that lets an attacker create an admin. CVSS 9.8. Added to CISA KEV around 14 November 2025, before the Decemb