Talk to an expert
ProductsSolutionsTrustPricingNewsTalk to an expert
Back to Newsroom
Threat Intel

CISA Warns: Ransomware Gangs Actively Exploiting Critical TeamCity Flaw

CISA has flagged CVE-2026-63077, a critical JetBrains TeamCity authentication bypass, as actively exploited by ransomware operators — patch on-premises servers immediately.

4T4Tify Team4Tify
Sep 24, 2026·4 min read
CISA Warns: Ransomware Gangs Actively Exploiting Critical TeamCity Flaw

CISA Warns: Ransomware Gangs Actively Exploiting Critical TeamCity Flaw

Federal cybersecurity officials are sounding the alarm on a critical vulnerability in JetBrains TeamCity, warning that ransomware operators have added it to their active toolkit.

What happened

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed this week that CVE-2026-63077 — a critical authentication bypass in TeamCity On-Premises — is now being abused in ransomware campaigns. JetBrains patched the flaw on July 25 in versions 2025.11.7 and 2026.1.3, but CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on August 5 after confirming in-the-wild exploitation, giving federal agencies a three-day window to secure their networks.

The vulnerability lets an unauthenticated attacker abuse the TeamCity agent polling protocol to bypass authentication entirely and run arbitrary operating system commands with the privileges of the TeamCity server process. A successful attack can expose stored credentials and configuration data, tamper with server state, and compromise the integrity of build artifacts — putting every downstream CI/CD pipeline connected to the server at risk.

Why it matters

This isn't TeamCity's first appearance in ransomware headlines. Since October 2023, four separate TeamCity vulnerabilities have made CISA's KEV catalog, and all four have gone on to be weaponized in ransomware attacks. State-sponsored groups have shown the same appetite: in late 2024, threat actors linked to Russia's Foreign Intelligence Service targeted vulnerable TeamCity and Zimbra servers at scale.

TeamCity sits at the center of the software delivery pipeline for more than 30,000 DevOps teams, including major enterprises. Compromising a build server doesn't just risk one company's data — it opens the door to supply-chain attacks against everyone who consumes the software it builds.

The good news: exposure is shrinking. Security researchers tracking internet-facing TeamCity servers report the number still vulnerable to this specific flaw has dropped from roughly 700 to just over 160 — but every one of those remaining servers is now a live target.

What to do

  • Patch TeamCity On-Premises to 2025.11.7 or 2026.1.3 (or later) immediately.
  • If you can't patch right away, restrict access to the TeamCity server to trusted networks only.
  • Review TeamCity server logs and configuration for signs of unauthorized access, unexpected build changes, or credential exposure.
  • Rotate any credentials stored in or accessible to the TeamCity server as a precaution.
  • Treat internet-facing CI/CD infrastructure as a high-value target in your ongoing patch management priorities.
SHARE