JetBrains disclosed a critical flaw in TeamCity On-Premises, the CI/CD server used by a huge share of enterprise build pipelines, that lets a completely unauthenticated attacker with network access to the server bypass its login checks entirely and run arbitrary operating-system commands with the privileges of the TeamCity process itself. The bug reaches through TeamCity's build-agent polling protocol rather than the normal login flow, which is why authentication does not stop it: the attacker never needs credentials at all. JetBrains first disclosed the flaw on July 27 after a researcher reported it privately, and shipped fixed versions (2025.11.7 and 2026.1.3) along with a security patch plugin for teams that cannot upgrade immediately. What makes this one worth tracking rather than filing away is what happened next: on August 7, JetBrains published a follow-up confirming it had started receiving reports of active exploitation and attempted exploitation against unpatched servers in the wild, upgrading this from a theoretical risk to a live one. Because TeamCity sits at the center of the software supply chain, holding stored credentials for source repos, artifact registries, and deployment targets, and deciding what gets built and shipped, a compromised server can be used to poison build artifacts or steal the credentials needed to reach further into a company's infrastructure, not just deface a CI dashboard. Teams running TeamCity On-Premises with the server reachable from any untrusted network should treat this as an emergency patch, not a routine one, and should also audit for signs of prior compromise given the gap between the July 27 disclosure and confirmed in-the-wild activity by early August. TeamCity Cloud customers were not affected.