CISA Confirms: TeamCity CVE-2026-63077 Now Used in Active Ransomware Campaigns

On September 23, 2026, the Cybersecurity and Infrastructure Security Agency modified the CVE-2026-63077 entry in the Known Exploited Vulnerabilities catalog, updating the "Known To Be Used in Ransomware Campaigns" field to "Known." The critical authentication bypass in JetBrains TeamCity On-Premises — patched in late July but still present on approximately 160 exposed servers — moves from manageable risk to immediate operational threat for software infrastructure.

KEV Designation Shifts: From Exploited to Ransomware-Specific

On August 5, 2026, CISA had already included CVE-2026-63077 in the KEV catalog with a three-day federal patching deadline. The September 23 change does not concern a new vulnerability discovery, but a risk reclassification: the same flaw is now labeled as an active tool in the hands of ransomware operators. According to BleepingComputer, since 2023 CISA has flagged four TeamCity vulnerabilities in the KEV, and all four have subsequently been linked to ransomware campaigns.

This historical pattern is significant. Continuous integration servers host deployment credentials, repository access tokens, code-signing keys, and pipeline configurations. Their compromise extends beyond a data breach: it enables build artifact manipulation and malicious code injection into distributed software.

Technical Mechanism: Deserialization via Agent Polling

The NVD record for CVE-2026-63077 assigns a CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CWE-502 classification indicates deserialization of untrusted data. The root-cause analysis published by Rapid7 on August 7, 2026, identifies the issue in an overly permissive XStream allowlist in the TeamCity agent polling protocol: the absence of NoTypePermission.NONE allows deserialization of arbitrary objects.

"JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol" — CISA, reported by The Hacker News

An unauthenticated attacker can send serialized payloads through the agent polling protocol, bypass authentication checks, and execute arbitrary commands on the system with the privileges of the TeamCity server process. Per the JetBrains advisory reported by BleepingComputer, the attacker gains "arbitrary operating system commands with the privileges of the TeamCity server process."

Timeline and Confirmed Exploitation

JetBrains released patches for versions 2025.11.7 and 2026.1.3 between July 25 and 27, 2026. On August 8, 2026, JetBrains confirmed in-the-wild exploitation through its own advisory. Rapid7 published technical analysis and proof-of-concept on August 7. The windowsforum.com source, which explicitly acknowledges relying on BleepingComputer for the ransomware news, notes that the ransomware designation represents a "change in the KEV field, not a new exploitation" — an operationally relevant distinction for security teams.

The JetBrains Cadence case, mentioned in some analyses, is not labeled as ransomware and is a separate event from the CISA designation of September 23. The dossier does not specify whether the ransomware exploitation is distinct from or overlaps with the generic exploitation confirmed in August, nor does it identify the ransomware group involved.

Immediate Actions

• Immediately verify the TeamCity On-Premises version in production: builds 2025.11.7 and 2026.1.3 or later remediate the vulnerability per the vendor advisory.
• Isolate or monitor servers still exposed on the internet: Shadowserver detects roughly 160 unpatched instances, each a potential supply-chain compromise vector.
• Review build artifacts distributed during the July–September 2026 window: compromise of a CI/CD server may have introduced unauthorized modifications into compiled code.
• Reconstruct the TeamCity server access timeline to identify potential anomalous activity prior to patch application, given the confirmation of in-the-wild exploitation from August 8.

Why Build Servers Are the New Preferred Target

The specific ransomware designation transforms the risk calculus. This is no longer a vulnerability to schedule in the ordinary patching cycle, but an attack vector with software supply chain impact. CI/CD servers represent a higher-value target than endpoint systems: a single compromise exposes not only corporate data, but trust in products delivered to customers.

The drop from roughly 700 to roughly 160 exposed servers signals that many organizations responded to the initial August alert. The remaining 160, however, are active nodes in a threat network that CISA has now explicitly classified as ransomware. For these, the absence of a patch is no longer an acceptable risk: it is a condition of an ongoing incident.

Sources

• https://www.bleepingcomputer.com/news/security/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/
• https://daily.dev/posts/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw-ivphb8400
• https://blog.netmanageit.com/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/
• https://windowsforum.com/news/cve-2026-63077-cisa-flags-teamcity-rce-in-ransomware-attacks.445780/
• https://thehackernews.com/2026/08/cisa-flags-teamcity-cve-2026-63077-rce.html
• https://tech-insider.org/jetbrains-teamcity-cve-2026-63077/
• https://nvd.nist.gov/vuln/detail/cve-2026-63077
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63077
• https://www.bleepingcomputer.com/