A new serious front is opening for businesses using the JetBrains TeamCity, as a critical security vulnerability is now being actively exploited by cybercriminals and is linked to ransomware. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed CVE-2026-63077 as a vulnerability that is being actively exploited, significantly increasing the pressure on organizations that have not yet implemented the necessary fixes.
The development is considered particularly important, as TeamCity is at the heart of many software development processes. A successful breach is therefore not limited to a single server, but can affect the entire CI/CD, from source code and credentials to final build artifacts.
Critical vulnerability with remote code execution capability
CVE -2026-63077 concerns TeamCity On-Premises and allows, under certain circumstances, an unauthorized remote attacker to bypass authentication mechanisms and execute arbitrary commands on the operating system.
The attack is carried out via agent polling protocol and does not require prior authentication, as the attacker can communicate via HTTP(S) with the vulnerable server. The level of access the attacker gains depends on the permissions with which the TeamCity process is running.
This means that an exposed server can be an entry point into much broader infrastructure. If the process has elevated privileges, the consequences can include accessing data and settings, stealing stored credentials, modifying the server state, and even interfering with build artifacts and subsequent stages of CI/CD pipelines.
See also: JetBrains Cadence: Breach via unupdated TeamCity
JetBrains has released fixes
JetBrains addressed the issue with TeamCity versions 2025.11.7 and 2026.1.3, and has also released a security patch plugin for older versions so that organizations that cannot immediately perform a full upgrade can mitigate the risk. These updates include important security fixes.
The company then warned that it has received reports of actual and failed attempts to exploit vulnerable TeamCity servers. For organizations that cannot immediately apply the update, JetBrains recommends temporarily restricting external access.
Administrators can also look for specific indications in server logs. The presence of messages such as ConversionException may indicate an attempted or successful exploit, while on updated systems ForbiddenClassException may indicate that an attack was attempted but blocked.
From vulnerability to ransomware
The most worrying thing is that the issue is no longer just a theoretical risk. CISA reports that CVE-2026-63077 is being used by ransomware groups, turning a vulnerability into a potential initial entry point for attacks with very serious operational consequences.
Targeting CI/CD infrastructures is particularly valuable to attackers. A TeamCity server can have access to repositories, credentials, tokens, cloud services, build agents, and internal systems. Therefore, compromising it can offer attackers more possibilities than simply infiltrating a single computer.
See also: TeamCity: Critical vulnerability allows offline command execution
Furthermore, the ability to interfere with the software creation and development process creates the risk of corrupting the resulting files or introducing malicious code into the development chain. This is a scenario that can turn an infrastructure vulnerability into a supply-chain incident.
TeamCity's history is worrying
TeamCity has been targeted by state-sponsored groups and ransomware operators in the past. The repeated attacks show that CI/CD servers are an attractive target precisely because they gather critical information and permissions required for software development.
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
This vulnerability is even more significant because it affects internet-facing installations. Shadowserver continues to monitor for exposed TeamCity servers and has incorporated CVE-2026-63077 into its checks for vulnerable HTTP services.
What should administrators do?
Organizations using TeamCity On-Premises should immediately check their server version and install any available patches. JetBrains also recommends limiting access to trusted networks only, using a VPN or additional layer of protection, and running TeamCity with the absolute necessary permissions.
Particular attention should also be paid to monitoring build agents. The appearance of unknown agents with names starting with scan may be an indication of an exploit attempt. On updated servers, such entries may correspond to attacks that were blocked, but should be investigated in conjunction with the relevant logs.
See also: JetBrains Plugins: 15 malicious plugins steal AI API keys
The case of CVE-2026-63077 is a reminder that software development platforms should not be treated as mere productivity tools. They are critical components of corporate infrastructure, often with access to code, secrets, cloud services, and automated development processes. When such infrastructure is exposed online, the speed of patching can determine whether a known vulnerability remains a fixed technical issue or escalates into a major ransomware incident.
source: www.bleepingcomputer.com
