# Your CI/CD Pipeline Is the Crown Jewel — and JetBrains Just Found Another Hole in the Safe
TeamCity has done this before. The pattern is almost ritual at this point: critical auth bypass, all On-Premises versions affected, patch immediately, no active exploitation *yet*. If that sounds familiar, it's because this is roughly the third time in three years that JetBrains has had to send engineering teams scrambling on a Friday.
The latest is CVE-2026-63077, disclosed July 27, and it's a clean 9.8 on the CVSS scale. An attacker with HTTPS access to a TeamCity server — that's it, just network reach — can bypass authentication through the agent polling protocol and execute arbitrary OS commands running under the server process's own privileges. No credentials needed. No foothold inside your network first. Just access.
## What the Agent Polling Protocol Being the Attack Surface Actually Means
This detail matters and most coverage is glossing over it: the vulnerability lives in the build agent polling mechanism, not a web login form or admin API endpoint. TeamCity's architecture is distributed — build agents check in with the central server over HTTPS to pick up jobs, return results, and sync configs. That communication channel is the exploitation path here.
The implication is subtle but ugly. Organizations that locked down their TeamCity server's admin UI and REST API behind a VPN felt reasonably secure. But if build agents need to reach the server from cloud environments, external CI runners, or dev machines across offices, you may have left HTTPS to the agent polling endpoint reachable. That's all this needs.
Daniel Gallo, JetBrains' Solutions Engineering Lead, spelled out what successful exploitation looks like: "TeamCity data, configurations, stored credentials, or compromise build artifacts and CI/CD pipelines, depending on privileges." Read that last phrase carefully — *depending on privileges* is doing heavy lifting there. Build server processes tend to run with elevated permissions precisely because they need to deploy software, push to registries, and access secrets vaults. In practice, "depending on privileges" often means "all of them."
## Three Years, Three Critical Bypasses
This is not JetBrains' first critical rodeo, and the history here is worth stating plainly.
In September 2023, CVE-2023-42793 — another TeamCity auth bypass — was weaponized by North Korea's Lazarus Group within weeks of disclosure. The goal wasn't ransomware. It was supply chain infiltration: get into a software vendor's build system, and you can potentially insert malicious code into software shipped to downstream customers. CISA, FBI, and NSA issued a joint advisory. Microsoft reported thousands of attempted intrusions.
Then in early 2024, CVE-2024-27198 dropped. Same class of vulnerability, same urgency. Active exploitation followed within days of the PoC going public.
CVE-2026-63077 was reported to JetBrains on July 10 and patched by July 27. Seventeen days from report to fix is actually decent turnaround. But there's currently no evidence it was burned as a zero-day, which means there's a short window where the patch exists and attackers are reverse-engineering it to write exploits against the unpatched population.
That window historically closes fast with TeamCity vulnerabilities.
## What Needs to Happen Before Monday Morning
JetBrains' recommended fix path:
Cloud customers are already protected; JetBrains handled that server-side.
JetBrains also took the opportunity to remind customers about basic hygiene: don't expose TeamCity directly to the internet. Put it behind a VPN or zero-trust gateway. Even the login page is an attack surface, because attackers watch for newly disclosed CVEs and immediately start scanning for exposed login portals.
That advice is correct but lands a bit awkwardly coming in the same advisory as a vulnerability that doesn't require reaching the login page.
## HackWire Analysis
The recurring CI/CD attack surface problem is one of the most underappreciated risks in enterprise security. Organizations spend heavily defending perimeter and endpoint, but build infrastructure often has quieter security investment. Build servers touch everything: source code, signing certificates, deployment credentials, cloud provider keys, artifact registries. A compromised CI/CD system isn't just a breached server — it's a potential malware distribution platform wearing your company's signature.
TeamCity specifically has become a preferred target not because JetBrains writes particularly bad software, but because it's deeply embedded in enterprise software delivery pipelines and the blast radius of compromise is extraordinarily high. The Lazarus Group wasn't interested in TeamCity data. They were interested in what TeamCity *touches*.
CVE-2026-63077's use of the agent polling protocol as an attack vector is particularly concerning for organizations running hybrid CI/CD setups — cloud-based agents checking in with on-premises orchestrators, or vice versa. These architectures often leave agent communication exposed in ways that traditional perimeter controls don't catch, because the assumption is that only trusted agents will be calling home. This vulnerability breaks that assumption completely.
The seventeen-day disclosure-to-patch window from JetBrains is responsible. But security teams need to treat the current "no active exploitation" status as a countdown, not a reassurance. With three prior TeamCity CVEs attracting both nation-state and criminal threat actors, the pattern strongly suggests PoC code will circulate within days of this article.
If you're running TeamCity On-Premises and you haven't patched yet, that's the only thing that matters right now.
— HackWire Editorial
## Related Coverage