CISA Flags TeamCity Flaw CVE-2026-63077 as Used in Ransomware Campaigns

WASHINGTON - The Cybersecurity and Infrastructure Security Agency has updated its Known Exploited Vulnerabilities catalog so that CVE-2026-63077, a critical JetBrains TeamCity On-Premises flaw, is now marked with known ransomware campaign use. Trade press reported the KEV change on Wednesday, September 23, 2026. CISA first added the vulnerability to the catalog on August 5, 2026, after evidence of active exploitation. The live KEV feed lists knownRansomwareCampaignUse as Known for this CVE.

JetBrains describes CVE-2026-63077 as unauthenticated remote code execution through the TeamCity agent polling protocol. An attacker with HTTP or HTTPS reachability to a vulnerable server can run operating system commands as the TeamCity server process, which can expose configurations and stored credentials, alter server state, and put build artifacts and downstream CI/CD pipelines at risk. Fixes shipped in TeamCity On-Premises 2025.11.7 and 2026.1.3. A security patch plugin covers older supported releases when an immediate upgrade is not possible. TeamCity Cloud customers do not need to act.

After disclosure, JetBrains said it received reports of active and attempted exploitation against unpatched servers. Defenders reviewing potential compromise should check teamcity-server.log for ConversionException messages that may indicate exploit attempts, ForbiddenClassException messages that may indicate blocked post-patch attempts, and unauthorized build agents, especially names beginning with scan. JetBrains also advises restricting internet exposure, preferring trusted networks or VPN fronting, and running the server with least privilege on a host separate from build agents.

For SOC and IR teams, treat internet-exposed, unpatched TeamCity as an urgent containment and forensics case, not only a patch ticket. Prioritize inventory of On-Premises instances, confirm version or plugin status, isolate public reachability until remediated, and triage credentials, agent registrations, and recent build integrity. Shadowserver, as cited by BleepingComputer on September 24, 2026, was tracking just over 160 internet-exposed servers still unpatched for this CVE, down from roughly 700 shortly after the July patch. CISA has not published a detailed ransomware operator attribution for this update; the operational signal is the KEV ransomware flag plus existing exploitation evidence.