CISA: Ransomware gangs now exploiting critical TeamCity flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) told federal agencies on Wednesday that a critical JetBrains TeamCity vulnerability is now also being exploited by ransomware gangs.

The vulnerability

Tracked as CVE-2026-63077, the flaw was patched by JetBrains on July 25 in TeamCity On-Premises versions 2025.11.7 and 2026.1.3. It is a critical authentication bypass that lets an attacker with HTTP(S) access execute arbitrary operating system commands.

Per JetBrains, an unauthenticated attacker can exploit the flaw through the TeamCity agent polling protocol, bypassing authentication checks and running commands with the privileges of the server process. Depending on those privileges, a successful attack could expose TeamCity data, configurations and stored credentials, alter server state, and threaten the integrity of build artifacts and downstream CI/CD pipelines.

Timeline

On August 5, CISA added the flaw to its catalog of actively exploited vulnerabilities and ordered federal agencies to secure their networks within three days. On August 7, JetBrains confirmed in-the-wild exploitation, shared indicators of compromise, and urged customers who could not patch immediately to restrict access to trusted networks.

This Wednesday the agency updated the catalog again, flagging the vulnerability as being abused by ransomware gangs. CISA has not yet shared details about those attacks.

Since October 2023, the agency has tagged four TeamCity security issues as exploited in the wild — all of which have also been abused in ransomware attacks.

Scope

Threat watchdog Shadowserver is now tracking just over 160 TeamCity servers still unpatched against CVE-2026-63077, down from the initial 700 Internet-exposed vulnerable servers spotted right after the patch shipped.

Because TeamCity flaws are also frequently leveraged by state-backed hacking groups, administrators are advised to patch Internet-exposed servers immediately. In October 2024, for instance, U.S. and U.K. agencies warned that Russia's SVR-linked APT29 group was targeting vulnerable JetBrains TeamCity and Zimbra servers "at a mass scale."

TeamCity is a continuous integration and delivery (CI/CD) platform that automates building, testing and deploying code. JetBrains says more than 30,000 DevOps teams use it, including at Citibank, Amazon Games, Tesla and Samsung.

Source: Bleeping Computer