As reported by BleepingComputer, CISA has updated its Known Exploited Vulnerabilities Catalog to flag CVE-2026-63077 — a critical authentication bypass in JetBrains TeamCity On-Premises — as actively abused by ransomware gangs. This escalation from generic exploitation to ransomware operations significantly raises the stakes for any organization still running unpatched instances.
Why This Matters More Than a Typical CVE
TeamCity is not just another server application — it is a CI/CD orchestration platform that sits at the intersection of source code, build artifacts, deployment credentials, and production access. When attackers achieve remote code execution on a TeamCity server, they don't just compromise one system. They potentially compromise the entire software supply chain downstream.
The vulnerability allows unauthenticated attackers to bypass authentication via the agent polling protocol and execute OS commands with the privileges of the TeamCity server process. This means access to:
The transition from nation-state espionage (APT29) to ransomware extortion represents the classic exploit lifecycle: intelligence services pioneer the attack path, then criminal operators industrialize it for profit.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE | CVE-2026-63077 |
| Severity | Critical (CVSS score not publicly confirmed; rated Critical by JetBrains) |
| Type | Authentication bypass leading to arbitrary OS command execution |
| Attack Vector | Unauthenticated, via TeamCity agent polling protocol over HTTP(S) |
| Affected Products | JetBrains TeamCity On-Premises (versions prior to 2025.11.7 and 2026.1.3) |
| Patch Available | Yes — fixed in TeamCity 2025.11.7 and 2026.1.3 (released July 25, 2026) |
| Active Exploitation | Confirmed in the wild; now abused by ransomware operators |
| CISA KEV Added | August 5, 2026; ransomware flag added September 24, 2026 |
| Exposure | ~160 unpatched Internet-exposed servers (Shadowserver), down from ~700 at disclosure |
Who Is at Greatest Risk
The remaining 160 exposed servers represent prime targets, but the risk profile extends well beyond internet-facing instances. Organizations most exposed include:
- Software development firms and SaaS providers — CI/CD compromise can trojanize customer-facing software
- Enterprises with legacy on-premises DevOps infrastructure — patching cycles often lag for internal tooling
- Government contractors and defense suppliers — supply chain attacks via build pipeline tampering
- Any organization where TeamCity runs with elevated service account privileges — common in environments where CI/CD needs broad deployment access
Shield53 Recommendations
Immediate Actions
- Patch immediately — Upgrade to TeamCity 2025.11.7 or 2026.1.3. This is non-negotiable for any instance, internet-facing or not.
- Restrict network access — If patching is delayed, limit TeamCity HTTP(S) endpoints to trusted networks via VPN, IP allowlists, or reverse proxy with authentication. Block the agent polling protocol from untrusted sources.
- Hunt for compromise — Review JetBrains IOCs published August 7. Look for unexpected build agent registrations, anomalous OS command execution under the TeamCity service account, and unauthorized changes to build configurations.
- Audit stored secrets — Assume all credentials stored in TeamCity are compromised. Rotate API tokens, deployment keys, cloud credentials, and repository access tokens.
- Review build artifact integrity — Compare recent build outputs against known-good hashes. Tampered artifacts may have already propagated to production.
Hardening for the Long Term
- Run TeamCity with least privilege — The service account should never have domain admin or broad cloud IAM permissions. Use scoped, short-lived credentials for deployment tasks.
- Isolate CI/CD infrastructure — Place build servers in segmented network zones with egress filtering. Agent communication should occur over dedicated channels, not the public internet.
- Implement build provenance and signing — Artifact signing with hardware-backed keys ensures tampered builds are detectable downstream.
- Enable comprehensive logging — Forward TeamCity audit logs, OS process logs, and network flow data to a SIEM. Alert on new agent registrations, authentication bypass attempts, and unexpected command execution.
- Establish a CI/CD patch SLA — Development tooling is infrastructure, not an afterthought. Treat critical CVEs in CI/CD platforms with the same urgency as domain controller vulnerabilities.
This is the fourth TeamCity vulnerability since October 2023 that CISA has flagged for both nation-state and ransomware exploitation. The pattern is clear: CI/CD platforms are now priority-one targets for both espionage and extortion operations. Organizations that continue to treat build infrastructure as lower-priority internal tooling are making a dangerous miscalculation. The remaining 160 unpatched servers are not statistics — they are imminent breach headlines.
