CISA has confirmed that ransomware gangs are actively exploiting a critical remote-code-execution flaw in JetBrains TeamCity, the CI/CD platform used by more than 30,000 development teams worldwide. The agency updated its Known Exploited Vulnerabilities catalog entry for CVE-2026-63077 on September 23, 2026, flagging the bug as tied to ransomware campaigns, according to BleepingComputer. The flaw carries a CVSS score of 9.8 and lets an unauthenticated attacker run arbitrary commands on a server that most companies treat as the heart of their software supply chain.
This isn’t a fresh disclosure. JetBrains patched CVE-2026-63077 back on July 25, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on August 5. The Hacker News first flagged the KEV addition in early August, and by that point the flaw had already been public for less than two weeks. What changed this week is the confirmation that ransomware operators, not just opportunistic scanners, are behind the ongoing attacks. That distinction matters for every security team still running an unpatched build server, and it puts TeamCity in the same September spotlight as F5’s BIG-IP zero-day and Cisco’s ISE flaw, both logged in the same 2026 wave of maximum-severity CISA alerts.
What CVE-2026-63077 actually does
CVE-2026-63077 is a deserialization vulnerability in TeamCity On-Premises, JetBrains’ self-hosted build automation server, running on the platform available at jetbrains.com/teamcity. A follow-up technical analysis from Rapid7 traced the root cause to an XStream allowlist that fails to strip a set of default type permissions, a finding later echoed in a community write-up on dev.to. An attacker who can reach the server over HTTP or HTTPS, with no credentials at all, can abuse the agent polling protocol to smuggle a malicious object into the server’s deserialization path and execute operating system commands with the privileges of the TeamCity server process.
The affected versions are TeamCity On-Premises 2025.11.6 and earlier, and 2026.1.2 and earlier. JetBrains shipped fixes in 2025.11.7 and 2026.1.3, both released July 25, 2026. Depending on what the TeamCity service account can touch, a successful attack can expose stored credentials, alter build configurations, plant backdoors in build artifacts, or pivot straight into a company’s CI/CD pipeline and everything it deploys.
Why build servers are such a valuable target
A CI/CD server like TeamCity sits between source code and production. It typically holds deployment keys, cloud credentials, and signing certificates, and it has network access to everything it builds and ships. Compromise one TeamCity instance and an attacker doesn’t just steal data, they gain the ability to poison software before it reaches customers. That’s precisely the profile ransomware crews look for when they want maximum leverage in a short window.
Timeline: from silent patch to ransomware warning
The gap between JetBrains’ fix and this week’s ransomware confirmation spans two months, and it shows how slowly patch adoption moves even for a maximum-severity bug. Here’s how the disclosure unfolded.
| Date | Event |
|---|---|
| July 25, 2026 | JetBrains patches CVE-2026-63077 in TeamCity 2025.11.7 and 2026.1.3 |
| August 5, 2026 | CISA adds CVE-2026-63077 to the KEV catalog, ordering federal civilian agencies to patch within three days |
| August 7, 2026 | JetBrains confirms active exploitation and tells customers who can’t patch immediately to restrict server access to trusted networks |
| Early September 2026 | Shadowserver counts roughly 700 internet-exposed, unpatched TeamCity servers |
| September 23-24, 2026 | CISA updates the KEV entry to flag ransomware-gang exploitation specifically; BleepingComputer reports the exposed-server count has fallen to about 160 |
| September 27, 2026 | The ransomware designation continues circulating among security teams as a live patch-now warning |
The drop from roughly 700 exposed servers to about 160 shows real progress, but it also means a meaningful chunk of internet-facing TeamCity instances remain unpatched more than eight weeks after a working fix shipped. For a company running exposed CI/CD infrastructure, that’s not a rounding error, it’s an open door.
CISA’s Known Exploited Vulnerabilities catalog and the compliance deadline
Every CVE that lands on the KEV catalog carries a federal patch deadline under CISA’s binding operational directives, and CVE-2026-63077’s three-day window (patch by August 8, 2026) was among the tightest categories the agency uses. That window only legally binds U.S. federal civilian executive branch agencies, but in practice the private sector treats a KEV addition as a hard signal: if CISA is telling federal IT teams to drop everything, everyone else running the same software should move just as fast.
CISA’s Known Exploited Vulnerabilities catalog has flagged four separate TeamCity security issues as actively exploited since October 2023, and every one of them has ended up tied to ransomware activity, per BleepingComputer’s reporting. That’s an unusual track record for a single product line, and it points to TeamCity being a recurring, not incidental, target for ransomware affiliates scanning the internet for CI/CD infrastructure.
Historical context: TeamCity has been a target before
This isn’t TeamCity’s first brush with nation-state-adjacent attention either. In October 2024, U.S. and U.K. cyber agencies warned that APT29, the hacking group linked to Russia’s Foreign Intelligence Service (SVR), was targeting vulnerable JetBrains TeamCity and Zimbra servers at mass scale. That campaign wasn’t ransomware, it was espionage, but it established the same underlying lesson: TeamCity’s footprint inside enterprise software pipelines makes it worth scanning the internet for, whether the end goal is data theft, sabotage, or a ransom note.
JetBrains has said more than 30,000 DevOps teams run TeamCity, at organizations including Citibank, Amazon Games, Tesla, and Samsung. That customer list is exactly why a single deserialization bug in a self-hosted build server can turn into a headline-grade ransomware story within weeks of the patch shipping.
How CVE-2026-63077 compares to 2026’s other critical CISA warnings
TeamCity isn’t the only maximum-severity bug CISA has pushed into the spotlight this month. September 2026 has produced a dense cluster of KEV additions and zero-day alerts across enterprise infrastructure vendors, several of them also tied to ransomware activity. Seeing CVE-2026-63077 next to that list helps explain why security teams describe this month as unusually heavy, even by 2026 standards.
| CVE | Product | CVSS | Ransomware-linked | Status |
|---|---|---|---|---|
| CVE-2026-63077 | JetBrains TeamCity | 9.8 | Yes (confirmed Sept. 23, 2026) | Patched, still under active attack |
| CVE-2026-59310 | VMware vCenter (Broadcom) | 9.8 | Yes (per shattered.io reporting) | Patched, ransomware activity confirmed |
| CVE-2026-76460 | Cisco ISE | 10.0 | Unconfirmed | No workaround available |
| Arista/VeloCloud zero-day | Arista | 10.0 | Unconfirmed | CISA gave a 3-day patch window |
| CVE-2026-94127 | F5 BIG-IP | 9.8 | Unconfirmed | Zero-day, actively tracked |
| CVE-2025-14733 | WatchGuard | Not disclosed | Yes (CISA KEV update) | Ransomware exploitation confirmed |
Two things stand out. First, a CVSS score of 9.8 or higher no longer guarantees urgent patching, since several of these bugs sat exposed for weeks after fixes shipped. Second, ransomware groups are now systematically working through CISA’s own KEV catalog looking for software that patched months ago but never got fully deployed, which is exactly the pattern seen with Arista’s VeloCloud zero-day and F5’s BIG-IP flaw earlier this month.
Market impact: what this means for DevOps security spending
Every time a CI/CD platform lands on the KEV catalog with a ransomware tag attached, the fallout extends beyond the vendor itself. Enterprise security teams that budget annually for application security tooling now have a fresh, concrete example to point to when asking for CI/CD-specific monitoring, network segmentation for build infrastructure, and faster patch cycles for internally hosted DevOps tools.
It also puts pressure on JetBrains’ own security posture. This isn’t an isolated incident for the company. JetBrains disclosed a separate breach affecting its Cadence product this year, a bug that stayed open for roughly two weeks before remediation, as shattered.io reported at the time. Two significant security incidents from the same vendor within one year gives enterprise buyers a reason to ask harder questions during procurement and renewal cycles, particularly for companies weighing self-hosted CI/CD against managed alternatives.
For managed CI/CD providers, this is a competitive opening. GitHub Actions, GitLab.com’s SaaS tier, and CircleCI all shift patch responsibility away from the customer, and incidents like CVE-2026-63077 are the exact argument their sales teams use against self-hosted build servers. Whether that argument converts into migration decisions depends on how many more TeamCity incidents surface before year-end.
There’s also a cost dimension that doesn’t show up in a CVSS score. Incident response for a compromised build server is expensive precisely because the blast radius is unclear at the start. A team has to assume the worst, that every credential the service account touched is burned, that every artifact built during the exposure window could be tampered with, and that customers downstream may need notification. That kind of full-pipeline audit takes far longer, and pulls in far more engineering time, than a straightforward file-server breach, even when the final forensic conclusion is that no attacker actually got in.
Detecting exposure without exploiting anything
Security teams don’t need a proof-of-concept to check whether they’re exposed. The version number alone tells you whether you’re vulnerable, since the fix landed in specific, named builds.
# Check the installed TeamCity version against JetBrains' patched builds
curl -s https://your-teamcity-server:8111/app/rest/server | grep -i version
# Patched builds: 2025.11.7 and 2026.1.3 (or later)
# If your server reports an earlier build:
# 1. Take it off the public internet immediately
# 2. Apply the July 25, 2026 patch
# 3. Rotate any credentials the TeamCity service account could reach
# 4. Review build logs for the period the server was exposedShadowserver’s ongoing internet-wide scan is the same technique at scale, which is how the organization tracked the exposed-server count falling from roughly 700 to about 160 over the past seven weeks. Any team still showing up in that scan should treat it as a live incident, not a routine patch backlog item. The official record for the flaw, including its CVSS vector string, is also published on the National Vulnerability Database, which is the fastest way to confirm you’re looking at the right bug before cross-checking it against your own asset inventory.
Why ransomware crews specifically want CI/CD access
Traditional ransomware plays go after file servers and backups, encrypting what a company needs to operate and demanding payment to restore it. A build server offers something different: leverage over what a company ships. An attacker sitting inside TeamCity can steal source code as a double-extortion bargaining chip, tamper with software before it’s signed and distributed, or simply use the server’s stored credentials as a stepping stone into cloud infrastructure that’s far more valuable than the build pipeline itself.
That’s also why CI/CD compromises tend to stay quiet longer than ransomware notes on a file server. There’s no immediate encryption event forcing disclosure. A patient attacker can sit inside a build environment for weeks, which is consistent with the pattern CISA has now tagged four separate times against this same product line since October 2023.
The extortion landscape isn’t limited to TeamCity
The same week CISA updated its TeamCity KEV entry, the ShinyHunters extortion gang was reported using a URL-encoding trick to bypass web application firewall rules protecting Oracle PeopleSoft servers vulnerable to CVE-2026-35273, resuming exploitation that defenders thought was mitigated. Separately, the Clop ransomware gang had to move its own data leak site to a new address after its previous infrastructure was compromised through an unpatched Grav CMS flaw, an ironic reminder that ransomware operators run vulnerable software too.
What security teams should do this week
- Confirm your TeamCity On-Premises build number matches 2025.11.7, 2026.1.3, or a later release
- If you can’t patch immediately, pull the server off the public internet and restrict access to a trusted VPN or internal network
- Rotate credentials, API tokens, and signing keys the TeamCity service account had access to, regardless of whether you’ve found evidence of compromise
- Review build and deployment logs from July 25 onward for unfamiliar agent connections or unexpected build triggers
- Add CVE-2026-63077 to your vulnerability management tracker even if you’re not a federal agency bound by CISA’s directive, since the ransomware designation applies to every exposed instance regardless of sector
Predictions: where this goes next
A few outcomes look likely from here, based on how similar KEV-to-ransomware timelines have played out this year.
- The exposed-server count keeps falling but never reaches zero. Shadowserver’s numbers for comparable KEV entries typically plateau in the low double digits rather than hitting zero, as some organizations run unmaintained or forgotten instances indefinitely.
- At least one named ransomware group gets publicly tied to the campaign. CISA’s current advisory doesn’t name a specific gang, but similar KEV updates this year have eventually been attributed to known ransomware-as-a-service operations once incident responders publish case studies.
- JetBrains faces renewed scrutiny over its 2026 security track record. With both the Cadence breach and now a ransomware-linked TeamCity flaw in the same year, expect enterprise security questionnaires to add JetBrains-specific line items during vendor risk reviews.
- Managed CI/CD vendors will use this in competitive positioning. Expect GitHub, GitLab, and CircleCI sales conversations to reference CVE-2026-63077 directly when pitching against self-hosted TeamCity deployments.
- More TeamCity CVEs will surface before the year is out. Four exploited-in-the-wild TeamCity vulnerabilities since October 2023 suggests researchers and attackers alike are still actively probing the platform’s deserialization and authentication code paths.
The bigger pattern: CISA’s KEV catalog as a ransomware roadmap
CVE-2026-63077 fits a pattern that’s become common through 2026: a vendor patches quietly, CISA adds the bug to its KEV catalog within days or weeks, and ransomware operators treat that catalog less as a warning and more as a target list of organizations that haven’t patched yet. The same dynamic played out with VMware’s vCenter flaw in September, and it’s consistent with how Conti-linked operators historically built their target lists around known, unpatched CVEs rather than novel zero-days, since patched-but-unapplied vulnerabilities are cheaper to weaponize at scale than genuine zero-days.
The takeaway for defenders is uncomfortable but simple: a patch existing since July doesn’t mean the risk ended in July. The KEV catalog is public, ransomware affiliates read it too, and every week a fix sits unapplied is a week a company stays on somebody’s active target list.
Frequently asked questions
What is CVE-2026-63077?
It’s a deserialization vulnerability in JetBrains TeamCity On-Premises with a CVSS score of 9.8. It allows an unauthenticated attacker to execute arbitrary operating system commands via the TeamCity agent polling protocol.
Which TeamCity versions are affected?
TeamCity On-Premises 2025.11.6 and earlier, and 2026.1.2 and earlier. JetBrains fixed the flaw in versions 2025.11.7 and 2026.1.3, released July 25, 2026.
Is CVE-2026-63077 actually being exploited by ransomware groups?
Yes. CISA updated its Known Exploited Vulnerabilities catalog entry on September 23, 2026, to specifically flag ransomware-gang exploitation, according to BleepingComputer’s reporting.
How many TeamCity servers are still vulnerable?
Shadowserver was tracking roughly 160 internet-exposed, unpatched TeamCity servers as of late September 2026, down from an initial count of about 700 shortly after the patch shipped.
What should I do if I run TeamCity On-Premises?
Check your build number against 2025.11.7 or 2026.1.3. If you’re on an earlier version, take the server off the public internet, apply the patch, and rotate any credentials the TeamCity service account could access.
Has TeamCity been targeted by attackers before?
Yes. CISA has tagged four separate TeamCity vulnerabilities as actively exploited since October 2023, all linked to ransomware activity. In October 2024, U.S. and U.K. agencies also warned that Russia’s APT29 group was targeting vulnerable TeamCity and Zimbra servers for espionage purposes.
Does this affect TeamCity Cloud, or only the self-hosted version?
The disclosed vulnerability and CISA’s advisory apply to TeamCity On-Premises, the self-hosted version of the platform. Reports reviewed for this story do not describe the same flaw affecting JetBrains’ cloud-hosted offering.
Who uses JetBrains TeamCity?
JetBrains says more than 30,000 DevOps teams use TeamCity, including at Citibank, Amazon Games, Tesla, and Samsung, based on the company’s own published customer references.
