CISA Links Critical TeamCity Flaw to Ransomware Attacks

CISA says ransomware groups are exploiting a critical vulnerability in JetBrains TeamCity. The agency has now marked the flaw as used in ransomware campaigns, after adding it to its list of known exploited vulnerabilities in August.

Authentication Bypass Gives Attackers Server Access

The vulnerability, CVE-2026-63077, affects TeamCity On-Premises. JetBrains released fixes on July 25, 2026, in versions 2025.11.7 and 2026.1.3.

An attacker who can reach a vulnerable TeamCity server over HTTP or HTTPS does not need to sign in. By exploiting a weakness in the agent polling protocol, the attacker can run operating system commands with the privileges of the TeamCity server process.

The impact depends on those privileges. An attacker could access stored credentials and configuration data, change server settings, or interfere with build artifacts and software delivery pipelines.

CISA Adds Ransomware Warning

CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on August 5. It directed U.S. federal agencies to address the flaw within three days.

JetBrains confirmed exploitation in the wild on August 7 and published indicators of compromise. It also urged customers who could not update immediately to restrict server access to trusted networks.

CISA later updated its catalog entry to mark the flaw as known to be used in ransomware campaigns. The agency has not publicly described the attacks behind that designation or identified the groups involved.

The update makes TeamCity ransomware attacks a concern for organizations still running vulnerable servers.

Exposed Servers Remain Vulnerable

Shadowserver was tracking just over 160 internet-exposed TeamCity servers that remained unpatched against CVE-2026-63077. That figure had fallen from about 700 vulnerable servers identified shortly after JetBrains released the fix.

Since October 2023, CISA has listed four TeamCity vulnerabilities as exploited in the wild. It has also marked all four as used in ransomware campaigns.

Administrators Should Update TeamCity

TeamCity helps development teams build, test and deploy software. A compromised server could therefore put stored secrets and connected delivery systems at risk.

Administrators should update affected installations to a fixed version, especially if the server is accessible from the internet. If they cannot patch immediately, JetBrains recommends limiting access to trusted networks.