TeamCity authentication bypass exposes all on-premises installations to unauthenticated RCE via agent polling protocol

The vulnerability stems from unsafe deserialization of untrusted data within TeamCity's agent polling protocol, a mechanism intended for communication between TeamCity agents and the central server. By targeting this protocol endpoint without authentication requirements, an attacker can craft malicious serialised objects that execute arbitrary code on the server with no credentials needed. The CVSS 9.8 score reflects the severe nature: network-accessible, low complexity, unauthenticated, and achieving full confidentiality, integrity, and availability compromise.

What makes this particularly dangerous is the targeting of the agent polling protocol specifically. This communication channel typically operates within trusted network perimeters and receives minimal security scrutiny compared to user-facing endpoints. The protocol's design for machine-to-machine communication means it often lacks the defensive layers applied to user authentication flows. Attackers can reach this endpoint if they have HTTP(S) access to the TeamCity instance, which in many organisations is restricted but may still be accessible from staging networks, development environments, or through VPN.

All earlier TeamCity On-Premises versions are affected. JetBrains fixed the flaw in TeamCity 2025.11.7 and 2026.1.3; TeamCity Cloud customers are unaffected and need take no action. TeamCity frequently holds build pipelines, artefacts and deployment credentials, so successful compromise could expose sensitive CI/CD resources.

Defenders should upgrade to a fixed release immediately. Organisations unable to upgrade can apply JetBrains' security patch plugin to TeamCity 2017.1 and later, although the plugin addresses only CVE-2026-63077. Network access should also be restricted to required users and systems.

JetBrains reported no known active exploitation at disclosure. That reduces evidence of immediate abuse but does not alter the urgency for internet-accessible or otherwise reachable on-premises servers.