Exploited TeamCity RCE Puts Build Servers in the Ransomware Crosshairs

A critical JetBrains TeamCity vulnerability is being used in ransomware campaigns after attackers began exploiting exposed servers without needing credentials.

Tracked as CVE-2026-63077, the flaw allows remote code execution through TeamCity’s agent-polling protocol. An attacker able to reach the service over HTTP or HTTPS can bypass authentication and execute operating-system commands with the privileges of the TeamCity server process.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 05, 2026. A later catalog update, reported on September 24, 2026, marked the flaw as associated with ransomware activity. Neither the ransomware operators nor specific victim incidents have been disclosed.

A pre-authentication path to operating-system commands

TeamCity is an on-premises continuous integration and continuous deployment platform used to automate software builds, testing and deployment. Its position inside development environments makes server-level compromise particularly consequential.

CISA classifies CVE-2026-63077 as a “JetBrains TeamCity Deserialization of Untrusted Data Vulnerability.” The NVD maps it to CWE-502, covering insecure deserialization, and assigns it a CVSS v3 score of 9.8.

The full vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

That assessment reflects a network-reachable attack requiring low complexity, no privileges and no user interaction. Successful exploitation can affect confidentiality, integrity and availability.

According to JetBrains’ technical explanation, an unauthenticated attacker can abuse the agent-polling protocol to evade authentication checks. The attacker can then run arbitrary commands in the context of the TeamCity server process.

The practical result depends on the permissions assigned to that process and the resources accessible from the host. A compromise could expose TeamCity data, configuration files and credentials stored or used by the service. Attackers could also alter server state or interfere with build jobs.

There is a broader integrity risk. Because TeamCity produces software artifacts and participates in deployment workflows, control of the server could provide opportunities to manipulate build outputs or downstream CI/CD processes. No specific supply-chain incident involving this vulnerability has been disclosed, however.

Patch information differs between release branches and records

The available version information is inconsistent and should not be reduced to one definitive affected range.

A September 24 report on the active ransomware exploitation says JetBrains fixed the vulnerability on July 25 in these TeamCity On-Premises releases:

• TeamCity On-Premises 2025.11.7
• TeamCity On-Premises 2026.1.3

The NVD’s structured product data lists jetbrains teamcity < 2025.11.7 as affected. Its descriptive text, however, says the vulnerability affects versions before both 2025.11.7 and 2026.1.3.

CISA’s alert does not specify affected or fixed versions. Administrators should therefore consult JetBrains’ upgrade instructions for the release branch deployed in their environment rather than relying on the NVD’s single structured range.

Internet-facing installations require immediate attention. Shadowserver was reportedly tracking slightly more than 160 TeamCity servers that remained unpatched against CVE-2026-63077. That figure had fallen from an initial count of approximately 700 exposed vulnerable servers observed shortly after the fixes became available.

Those figures represent observable internet exposure, not a complete count of vulnerable systems. TeamCity instances reachable through corporate networks, VPNs or other restricted paths may not appear in such scanning data.

KEV listing confirms exploitation, while ransomware details remain limited

CISA added CVE-2026-63077 to the KEV catalog on August 05, 2026, based on evidence that attackers were already exploiting it.

The remediation deadline recorded for U.S. federal agencies was August 08, 2026. The required action directs agencies to apply vendor mitigations, follow BOD 26-04 risk-based patching guidance and meet CISA’s Forensics Triage Requirements. Agencies must also assess each asset’s internet exposure.

For relevant cloud services, the action calls for following applicable BOD 26-04 guidance. If mitigations are unavailable, the affected product must be discontinued.

JetBrains confirmed in-the-wild exploitation on August 7 and reportedly distributed indicators of compromise. The actual indicator values have not been made public in the available information, so there are no specific IP addresses, file hashes, domains or filenames to provide.

A later KEV update identified ransomware use, while the NVD record also marks the flaw as used in ransomware campaigns. CISA has not named a ransomware group, described its intrusion chain or published incident-level evidence.

The distinction matters operationally. Active exploitation and ransomware use are confirmed, but the available data does not establish which operators are responsible, how they discover targets or what ransomware payload follows TeamCity compromise.

TeamCity’s role expands the potential impact

JetBrains says more than 30,000 DevOps teams use TeamCity. Reported users include teams at Citibank, Amazon Games, Tesla and Samsung, though there is no indication that any of those organizations were compromised through CVE-2026-63077.

A TeamCity server can occupy a trusted position between source repositories, build agents, artifact stores and deployment systems. It may also handle service credentials or tokens needed to interact with those systems.

Consequently, responders should not treat exploitation as an isolated web-server event. The investigation scope may need to include connected build agents, repositories, artifact registries and credentials available to the TeamCity process.

This is also not TeamCity’s first appearance in CISA’s exploited-vulnerability data. Since October 2023, CISA has identified four TeamCity security issues as exploited in the wild, and all four were reportedly associated with ransomware attacks. The other three vulnerabilities were not named in the available reporting.

Previous TeamCity flaws have also attracted state-backed operators. U.S. and U.K. cyber agencies warned in October 2024 that APT29, linked to Russia’s Foreign Intelligence Service, was targeting vulnerable TeamCity and Zimbra servers at scale. There is no evidence attributing the current ransomware exploitation to APT29.

Administrators should patch and investigate, not merely upgrade

Organizations running TeamCity On-Premises should first identify every deployment, including forgotten test instances and servers exposed through reverse proxies. Publicly reachable systems should be prioritized.

Administrators should then:

1. Upgrade using JetBrains’ instructions. The reported fixed releases are 2025.11.7 and 2026.1.3, but the applicable destination depends on the installed release branch.
2. Restrict access when immediate patching is impossible. JetBrains advised limiting TeamCity access to trusted networks until the server can be updated.
3. Check for compromise before and during remediation. Installing a fixed version does not remove an attacker who already obtained command execution or established persistence.
4. Review the privileges of the TeamCity process. Investigators should determine which files, credentials, repositories and connected systems were accessible under that account.
5. Expand the investigation to CI/CD dependencies. Build agents, artifacts, pipeline definitions and deployment credentials may require validation if server compromise is suspected.
6. Obtain JetBrains’ published indicators directly. Indicator values are known to have been shared, but none are available in the disclosed material.

Where evidence of exploitation appears, organizations should rotate credentials accessible to TeamCity and verify the integrity of builds produced during the suspected compromise window. The exact investigative steps will depend on local architecture and logging.

CVE-2026-63077 is no longer a theoretical patching concern. It is a remotely exploitable, unauthenticated server flaw listed in KEV and flagged for ransomware use, with exposed unpatched systems still visible online.