Critical JetBrains TeamCity Flaw Enables Unauthenticated Remote Code Execution

JetBrains disclosed a critical unauthenticated RCE in TeamCity On‑Premises (CVE-2026-63077) that allows attackers with network access to bypass authentication via the agent polling protocol and execute arbitrary OS commands. JetBrains released fixes in TeamCity 2025.11.7 and 2026.1.3 and a security patch plugin for supported older releases; TeamCity Cloud has mitigations and no evidence of active exploitation. Organizations are urged to upgrade or apply the plugin, restrict network exposure, run the server with minimal OS privileges, and isolate build infrastructure to reduce supply-chain and lateral-movement risk.