Vulnerability scanner reports an outdated TeamCity version on Windows: stale registry version

Problem

A vulnerability scanner (for example, Tenable, Nessus, or Qualys) reports an outdated, vulnerable TeamCity version on a Windows server. On the same server, the TeamCity web UI shows a newer, current version. Windows Add or Remove Programs also shows the older version.

Cause

An automatic TeamCity update on Windows can fail to write the new version number to the Windows registry uninstall key. Add or Remove Programs and vulnerability scanners read the product version from that registry key. They report the stale version even though the running server is already up to date. The mismatch comes from the stale registry value, not from a second, outdated installation on disk.

Resolution

1. Open the Administration | Updates page in the TeamCity web UI to see the version that is actually running.
2. Run the bundled PowerShell script from that page to update the registry value.
3. Re-run the vulnerability scan. It now reports the running version, and the finding clears.

The Administration | Updates page shows the exact command. The documented form is:

runas /user: Administrator "powershell -File C:\TeamCity\bin\update-registry-version.ps1"

Replace C:\TeamCity\bin with the bin directory of the actual TeamCity installation (for example, D:\TeamCity\bin).

For the full description of this known issue, see Incorrect TeamCity Server Version in Windows in the TeamCity documentation.