CISA flags ransomware use of JetBrains TeamCity flaw CVE-2026-63077

CISA flags ransomware use of JetBrains TeamCity flaw CVE-2026-63077

23 September 2026 — The US Cybersecurity and Infrastructure Security Agency (CISA) now lists CVE-2026-63077, a critical flaw in JetBrains TeamCity On-Premises, as known to be used in ransomware campaigns. The flag appears in CISA's Known Exploited Vulnerabilities (KEV) catalogue, version 2026.09.23. BleepingComputer reported the change on 24 September and said CISA made it on Wednesday 23 September.

The flaw

TeamCity is a build and continuous-integration server. JetBrains' advisory was first posted on 27 July 2026 and updated on 7 August. It says all versions of TeamCity On-Premises are affected, and that an unauthenticated attacker with HTTP(S) access to the server can bypass authentication checks and run operating-system commands. The fixed versions are 2025.11.7 and 2026.1.3. Where an upgrade cannot happen at once, JetBrains offers a security patch plugin for TeamCity 2017.1 and later. TeamCity Cloud is not affected, and its customers need take no action.

CISA added the flaw to the catalogue on 5 August 2026 and gave US federal agencies until 8 August to act. The entry describes a deserialisation weakness in the agent polling protocol. It also marks the flaw for forensic triage, meaning agencies should look for signs of compromise as well as patch.

Why the ransomware flag matters

A build server holds source code, signing keys, cloud credentials and deployment secrets. An attacker who controls it can steal them or tamper with what the build ships. The new flag tells defenders that criminal groups, not only espionage actors, are using this flaw. Citing Shadowserver, BleepingComputer reported that just over 160 internet-exposed TeamCity servers were still unpatched as of 22 September. That is Shadowserver's count, not a vendor figure.

Who is affected

This affects any organisation that runs TeamCity On-Premises, and any software supplier whose releases are built on it. A buyer who does not run TeamCity may still depend on a supplier who does.

What buyers should do

• If you run TeamCity On-Premises, confirm you are on 2025.11.7, 2026.1.3 or later, or that the patch plugin is installed.
• Take the server off the open internet or put it behind a VPN, as JetBrains advises.
• If your server was exposed and unpatched at any point since late July, treat it as possibly compromised. Review users, access tokens, build configurations and agents, and rotate every secret the server stores.
• Ask key software suppliers whether they use TeamCity On-Premises. If they do, ask when they patched and whether they checked for compromise.
• Run TeamCity with no more operating-system privilege than it needs.

Sources

• CISA Known Exploited Vulnerabilities catalogue, CVE-2026-63077 (catalogue version 2026.09.23) — 23 September 2026
• JetBrains TeamCity blog: CVE-2026-63077 advisory (updated 7 August 2026) — 27 July 2026
• BleepingComputer: CISA: Ransomware gangs now exploiting critical TeamCity flaw — 24 September 2026