The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on September 24, 2026, that ransomware gangs are now also exploiting a critical JetBrains TeamCity flaw patched in July. Tracked as CVE-2026-63077, the issue is an authentication bypass in TeamCity On-Premises. An unauthenticated attacker with HTTP(S) access can abuse the agent polling protocol to bypass authentication checks and execute arbitrary operating-system commands with the privileges of the TeamCity server process. That can expose configurations and stored credentials, alter server state and undermine the integrity of build artifacts and downstream CI/CD pipelines — the software supply chain.
JetBrains fixed the flaw on July 25 in versions 2025.11.7 and 2026.1.3. On August 5, CISA added CVE-2026-63077 to KEV and ordered federal agencies to secure networks within three days. On August 7, JetBrains confirmed in-the-wild exploitation, shared IoCs and urged customers who could not patch immediately to limit access to trusted networks. Wednesday's update raises the stakes: the same vulnerability is now explicitly flagged as abused by ransomware actors. Since October 2023, CISA has listed four TeamCity issues as exploited in the wild — all also tied to ransomware campaigns.
Shadowserver now tracks just over 160 still-unpatched TeamCity servers exposed online, down from roughly 700 right after the patch. The decline looks hopeful but every remaining node is high value: JetBrains says more than 30,000 DevOps teams use TeamCity at firms including Citibank, Amazon Games, Tesla and Samsung. State-backed groups have also hunted the product — in October 2024, U.S. and U.K. agencies warned that APT29 (linked to Russia's SVR) was mass-targeting vulnerable TeamCity and Zimbra servers.
For Nordic engineering orgs, municipalities with in-house build pipelines and SaaS vendors the message is clear: inventory internet-exposed TeamCity On-Prem, upgrade to patched builds, and never leave build servers public without strong network segmentation. A compromised CI/CD node can inject backdoors into artifacts that reach thousands of customers — ransomware is only the beginning.
Concrete steps for DevOps and security
1. Upgrade TeamCity On-Prem to at least 2025.11.7 or 2026.1.3 immediately. 2. If patching is delayed: restrict HTTP(S) to VPN/trusted networks; block agent polling from the internet. 3. Rotate credentials stored in TeamCity; review build history for suspicious jobs. 4. Hunt JetBrains August IoCs across servers and reverse proxies. 5. Move critical pipelines behind bastion/zero-trust and enable MFA for admins.
Evidence Rail
- Confirmed: CISA KEV update with ransomware flag; JetBrains July 25 patch and August 7 wild confirmation.
- Reported: Shadowserver ~160 unpatched exposed servers; four TeamCity CVEs historically in KEV.
- Unconfirmed: Which specific ransomware families CISA intends in the latest flag.
In Brief
- CVE-2026-63077 in TeamCity enables unauthenticated command execution and is now abused by ransomware gangs.
- Patches have existed since 25 July (2025.11.7 / 2026.1.3); remaining public nodes are urgent risk.
- CI/CD compromise threatens both internal operations and the software supply chain.