CISA flags exploited TeamCity auth bypass CVE-2026-63077 as used in ransomware attacks

CISA has updated its Known Exploited Vulnerabilities entry for a critical JetBrains TeamCity flaw to record that ransomware operators are now abusing it. The update was published on Wednesday and reported by BleepingComputer [1]. The vulnerability, CVE-2026-63077, was already in the catalogue — it was added on 5 August, and CISA ordered U.S. federal agencies to remediate within three days [1].

JetBrains fixed the issue on 25 July in TeamCity On-Premises 2025.11.7 and 2026.1.3, describing it as a critical authentication bypass that allows an attacker with HTTP(S) access to run operating system commands [1]. The vendor confirmed in-the-wild exploitation on 7 August, released indicators of compromise, and told customers who could not patch immediately to restrict access to trusted networks [1].

The severity here is critical. The CVE carries a CVSS score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges and no user interaction required, with high impact to confidentiality, integrity and availability. CISA’s KEV record marks ransomware use as known and sets a due date of 8 August.

Who is affected

Self-hosted TeamCity On-Premises servers running versions before 2025.11.7 or 2026.1.3 are affected. TeamCity is a CI/CD platform used to build, test and deploy code. JetBrains says more than 30,000 DevOps teams use it, at high-profile companies including Citibank, Amazon Games, Tesla and Samsung [1]. The sources do not state whether TeamCity Cloud instances were affected or remediated separately.

Shadowserver is currently tracking just over 160 internet-exposed TeamCity servers that remain unpatched against CVE-2026-63077, down from roughly 700 seen shortly after the fix shipped [1]. That is meaningful progress, but the remaining population is exactly the kind of target ransomware crews look for: a high-value internal system with credentials in it, reachable from the internet.

This is not the first time. Since October 2023, CISA has listed four TeamCity vulnerabilities as exploited in the wild, and all four have been tied to ransomware activity [1]. In October 2024, U.S. and U.K. agencies warned that APT29, linked to Russia’s SVR, was going after vulnerable TeamCity and Zimbra servers at large scale [1].

How it works

According to JetBrains’ description as quoted by BleepingComputer, an unauthenticated attacker reaches the TeamCity agent polling protocol, bypasses the server’s authentication checks, and executes operating system commands with the privileges of the TeamCity server process [1]. The NVD description matches: unauthenticated remote code execution via the agent polling protocol.

The consequences follow from what a build server holds. JetBrains noted that a successful attack could expose TeamCity data, configuration and stored credentials, alter server state, and affect the integrity of build artifacts and downstream CI/CD pipelines [1]. In practice, that means signing keys, deployment credentials and cloud tokens should be treated as exposed on any server that was reachable and unpatched, and that artifacts produced during that period cannot be assumed clean.

CISA has not published details of the attacks, and the KEV update does not name the ransomware groups involved [1]. The available source also does not establish when exploitation began — only that JetBrains confirmed in-the-wild abuse on 7 August [1] — so the true exposure window for any given server is unknown. The source does not reproduce JetBrains’ indicator list either, so defenders should pull those directly from the vendor advisory rather than rely on secondary reporting.

What to do

• Patch now. Upgrade TeamCity On-Premises to 2025.11.7 or 2026.1.3 or later [1]. If you are a U.S. federal agency in scope, the KEV due date of 8 August has already passed; treat this as overdue, not pending.
• Take exposed servers off the internet. If you cannot patch immediately, restrict access to trusted networks as JetBrains advised, and put the agent polling endpoint behind a VPN or allowlist [1].
• Treat credentials on any exposed, unpatched server as compromised until proven otherwise. No source states when exploitation started, so as a precaution use the full period between the 25 July patch release and the day you upgraded. Rotate service accounts, VCS tokens, cloud deployment credentials, signing keys and stored secrets held by TeamCity.
• Retrieve JetBrains’ indicators of compromise from the vendor advisory and hunt across server logs, agent registrations and process creation telemetry on the TeamCity host [1].
• Review build integrity. Check for unexpected build configuration changes, new administrative users, and artifacts published outside normal pipeline runs.
• Reduce the blast radius. Run the TeamCity server process with the minimum privileges it needs, since the flaw executes commands at that privilege level [1].
• Watch KEV entries for products you run. The ransomware flag on this CVE was added weeks after the initial listing; an entry you triaged in August can change meaning later [1].