TeamCity flaw CVE-2026-63077 now used by ransomware gangs

A critical authentication bypass in JetBrains TeamCity is now being abused by ransomware operators, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The agency flagged the change on Wednesday, two months after JetBrains released a fix.

The vulnerability, tracked as CVE-2026-63077, affects TeamCity On-Premises. JetBrains patched it on July 25 in versions 2025.11.7 and 2026.1.3. Attackers who can reach a server over HTTP(S) can use it to run arbitrary operating system commands.

How the flaw works

TeamCity is a Continuous Integration and Continuous Deployment (CI/CD) platform. Developers and DevOps teams use it to automate how software code is built, tested and deployed. That role makes a compromised server valuable to attackers.

JetBrains described how the bug can be exploited in its advisory.

"An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process," the company said.

It also warned about what an attacker could reach after getting in.

"Depending on the privileges granted to the TeamCity server process, a successful attack could expose TeamCity data, configurations, and stored credentials, modify server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines," JetBrains added.

The last point matters most. A build server sits upstream of the software that an organisation ships. If build artifacts are tampered with, the damage can spread well beyond the first victim.

From patch to active exploitation

Attacks started soon after the fix was released. On August 5, less than two weeks after the patch, CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog. The KEV catalog is CISA's list of security flaws confirmed to be exploited in real attacks. Under a binding directive, U.S. federal civilian agencies must fix listed flaws by a set deadline. In this case, CISA gave agencies three days to secure their networks.

JetBrains confirmed in-the-wild exploitation on August 7. It published indicators of compromise and advised customers who could not patch right away to restrict access to trusted networks.

On Wednesday, CISA updated the KEV entry again to mark the vulnerability as used in ransomware campaigns. The agency has not said which groups are behind the attacks or how they were carried out.

This is not the first time TeamCity has drawn this kind of attention. Since October 2023, CISA has tagged four TeamCity vulnerabilities as exploited in the wild. All four have also been linked to ransomware attacks.

Fewer exposed servers, but not zero

Patching has made progress. The non-profit threat monitoring group Shadowserver counted around 700 vulnerable TeamCity servers exposed to the Internet shortly after the fix came out. It now tracks just over 160 servers that remain unpatched against CVE-2026-63077.

That is a clear drop, but 160 reachable build servers are still a sizeable target pool, especially for a bug that needs no authentication.

TeamCity has a history of attracting both criminal and state-backed attackers. In October 2024, U.S. and U.K. cyber agencies warned that APT29 was targeting vulnerable JetBrains TeamCity and Zimbra servers "at a mass scale." APT29 is a hacking group linked to Russia's Foreign Intelligence Service (SVR).

The reach of the product explains why. JetBrains says more than 30,000 DevOps teams use TeamCity, including teams at well-known companies such as Citibank, Amazon Games, Tesla and Samsung.

Administrators running Internet-facing TeamCity On-Premises servers are advised to install the patched versions immediately. Where that is not possible, access should be limited to trusted networks, and the indicators of compromise published by JetBrains should be checked.

Our Take

The timeline here follows a familiar pattern. A patch is released, exploitation is confirmed within days, and ransomware groups move in later. This suggests that the window between a fix and criminal abuse keeps shrinking, and that servers still unpatched two months on should be treated as possibly compromised, not just vulnerable.

The pattern is not limited to developer tools. We recently covered a Roundcube flaw exploited in attacks, another case where Internet-facing software drew attackers soon after disclosure.

CI/CD platforms deserve special attention. Stored credentials and build pipelines give attackers a path into other systems and, potentially, into the software that customers install. It is worth watching whether CISA or JetBrains release details on the ransomware activity, and whether the number of exposed servers tracked by Shadowserver keeps falling. Teams that have already patched should still check for signs of earlier intrusion.