CISA: Ransomware Gangs Exploiting TeamCity RCE Flaw

Ransomware operators are exploiting CVE-2026-63077, an unauthenticated remote code execution flaw in JetBrains TeamCity On-Premises. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 5. The U.S. government warning and ransomware exploitation reporting followed; no specific ransomware group was named in the cited alert.

JetBrains’ security advisory says all on-premises TeamCity versions are affected. The company fixed the flaw in versions 2025.11.7 and 2026.1.3. TeamCity Cloud customers do not need to take action for this vulnerability because JetBrains applied the necessary measures to that service.

Administrators who cannot upgrade immediately have a vendor-provided security patch plugin for TeamCity 2017.1 and later. JetBrains says the plugin addresses this CVE only, so it is a temporary mitigation rather than a substitute for upgrading. For TeamCity 2024.03 and newer, the plugin can appear under Administration → Updates → Available security updates. Older versions may require a manual download; follow JetBrains’ installation instructions and confirm the patch is enabled.

This server is a high-value target because it can hold project configuration, credentials, and build artifacts. JetBrains warns that a compromise can affect downstream CI/CD pipeline integrity. Restrict network access to trusted networks, run the service with the minimum required operating-system privileges, and keep the server separate from build agents where possible.

The sequence shows why a patched build is not enough if an exposed server remains behind: JetBrains disclosed the fix in July, CISA confirmed exploitation in August, and reporting in September connected an unpatched TeamCity instance to a breach. Our earlier coverage tracks the initial advisory, Rapid7’s analysis, and the JetBrains Cadence incident.