Critical vulnerability in TeamCity exploited in ransomware attacks

A critical vulnerability discovered in JetBrains' build and deployment tool, TeamCity, is being exploited in ransomware attacks. The Cybersecurity and Infrastructure Security Agency (CISA) has registered CVE-2026-63077 as a vulnerability that is already being abused, and it has now classified it as being used in ransomware attacks. The agency has not disclosed which organizations have been targeted or the specifics of the attacks.

The vulnerability affects TeamCity installations that organizations operate on their own servers. If attackers can access a vulnerable server via the web, they can bypass authentication without logging in and execute commands on the server. JetBrains has indicated that the communication process between the TeamCity server and the build agent is the attack vector.

TeamCity is used to retrieve source code and build and deploy applications. Consequently, if the server is compromised, stored account information and configurations may be exposed, affecting both the build outputs and subsequent deployment processes. JetBrains released a fixed version in July, and in August, actual attacks targeting unpatched servers were reported. The recent classification change by CISA highlights the confirmed link between exploitation and ransomware attacks.

There have been actual breach instances. JetBrains reported that its cloud development service, Cadence, was compromised through this vulnerability. Investigations revealed that user personal information was leaked, and credentials as well as sensitive information for multiple Amazon Web Services accounts in the server backup for 2024 were compromised. However, JetBrains did not classify the Cadence breach as a ransomware attack, and there is no evidence to suggest that the two incidents are related.

Organizations using TeamCity are urged to immediately verify if their servers can be accessed externally and check their installed versions. JetBrains recommends updating to versions released on November 7, 2025, or January 3, 2026, or later versions. If immediate upgrades are not feasible, they should apply the provided security patch plugins and restrict external access until remediation is complete.

If vulnerable servers have been exposed, simply applying a patch is not sufficient. Experts recommend investigating server logs and checking for unauthorized build agent registrations. If a breach is suspected, credentials connected to source repositories, deployment systems, and cloud services should be replaced.