TeamCity vulnerability CVE-2026-63077: the attack chain that leads to ransomware
The TeamCity vulnerability CVE-2026-63077, rated 9.8 out of 10, is now being used by ransomware groups. On September 23, 2026, the U.S. agency CISA flagged this flaw as “known to be used in ransomware campaigns”. It had already been in CISA’s catalog of actively exploited vulnerabilities since August 5. JetBrains, the maker of TeamCity, released the fix in late July 2026.
TeamCity is a continuous integration (CI) server: it automatically builds, tests and ships a development team’s software. If your SMB builds its own applications, or a vendor does it for you, there may be a TeamCity server somewhere in the chain.
What you need to know in 30 seconds
- Affected versions: TeamCity On-Premises up to 2025.11.6 and 2026.1.2. Versions 2025.11.7 and 2026.1.3 fix the flaw; a security patch plugin is available for older versions (2017.1 and later).
- No password needed: simple network access (HTTP or HTTPS) to the server is enough to run commands on it.
- Even JetBrains was hit: its Cadence service, which ran on an unpatched TeamCity server, was breached between August 8 and 24, 2026. Attackers accessed a backup containing AWS credentials and files stored in JetBrains’ AWS accounts.
The attack chain in 4 steps
1Exposed CI server
An unpatched TeamCity On-Premises server is reachable from the internet over HTTP or HTTPS, often so developers or build agents can connect from outside.
2Code execution without a password
The attacker exploits the flaw through the build agent polling protocol. No authentication is needed: commands run with the TeamCity server’s privileges.
3Secrets stolen
TeamCity holds the keys that run your deliveries: cloud access (AWS, Azure), GitHub tokens, deployment passwords, sometimes code-signing keys.
4Ransomware or pivot
With those secrets, the attacker encrypts your servers, moves into your cloud accounts or tampers with your built software to reach your customers.
The danger of a TeamCity vulnerability goes beyond the server itself: it’s a vault of keys. Once those keys are stolen, patching the server is no longer enough; you also have to replace them.
Do you have an exposed TeamCity server?
Checklist: TeamCity vulnerability CVE-2026-63077
- ☐ Do you (or your software vendor) run a TeamCity server on your premises or in your own cloud?
- ☐ Is it on version 2025.11.7, 2026.1.3 or later, or is JetBrains’ security patch plugin installed?
- ☐ Is its address reachable from the internet without a VPN or IP filtering?
- ☐ Are there unknown entries in the unauthorized agents list, for example agents whose names start with “scan”?
- ☐ Have the AWS, Azure, GitHub and signing keys stored in TeamCity been rotated since the update?
- ☐ Has anyone reviewed the server logs since July 2026?
If you answer “yes” to the first question and “no” to the second, treat it as a possible intrusion: take the server off the internet, update it, rotate every secret it holds and review the logs. If your vendor runs TeamCity, ask them these questions in writing.
What if you don’t have a development team?
The lesson is the same as for tools like Jira and Confluence: internal tools set up “for the team” often end up exposed to the internet and left out of updates. An inventory of what’s visible from outside, rigorous server management and automated 24/7 monitoring with on-call technician response greatly reduce that risk. See also our cybersecurity services.
Book your free cyber check
Not sure which of your SMB’s servers are visible on the internet? Our free cyber check finds exposed services and unpatched software, and gives you a clear, jargon-free plan.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- JetBrains — Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077)
- JetBrains — CVE-2026-63077: Additional Guidance Following Reports of Active Exploitation
- JetBrains — Security Incident Affecting JetBrains Cadence
- NIST NVD — CVE-2026-63077
- SOCtember — CISA Flags TeamCity Flaw CVE-2026-63077 as Used in Ransomware Campaigns
- The Hacker News — Attackers Breached JetBrains Cadence via Unpatched TeamCity
Photo: Jakub Zerdzicki, Pexels (Pexels licence).