JetBrains warns of critical TeamCity remote code execution flaw

A critical authentication bypass vulnerability (CVE-2026-63077) in JetBrains TeamCity On-Premises allows any attacker with HTTPS access to circumvent authentication entirely and execute arbitrary commands with server-level privileges — no credentials required. This is especially dangerous because TeamCity is a CI/CD platform, meaning a compromised server can be weaponized to inject malicious code into build pipelines and software supply chains. The root cause reflects a failure in secure authentication design combined with delayed patching exposure for on-premises users. Organizations running unpatched versions remain fully exposed until upgrades or plugin patches are applied, highlighting the critical importance of rapid response to vendor security advisories.