GoKawiilCISA says ransomware groups now exploit JetBrains TeamCity flaw CVE-2026-63077
CISA updated its Known Exploited Vulnerabilities catalog to flag CVE-2026-63077, a critical TeamCity authentication bypass patched by JetBrains on July 25, as now being abused in ransomware attacks. JetBrains had already confirmed in-the-wild exploitation on August 7, and CISA had ordered federal agencies on August 5 to secure their systems within three days. Shadowserver currently tracks roughly 160 unpatched TeamCity servers still exposed to the flaw.
GoKawiil's interpretation of the reporting above, not reported fact.
This marks the fourth TeamCity vulnerability since October 2023 that CISA has tagged as both actively exploited and used in ransomware campaigns, suggesting attackers repeatedly target CI/CD infrastructure to gain deep access to build pipelines and credentials. Organizations running unpatched TeamCity servers could face not just data theft but compromised software supply chains, since attackers gain server-level privileges over build artifacts. The relatively small but persistent number of exposed servers indicates patching gaps remain even after public warnings and federal deadlines.
- CVE-2026-63077 is a critical unauthenticated TeamCity flaw patched July 25, now added to CISA's actively exploited list.
- JetBrains confirmed real-world exploitation on August 7 and shared indicators of compromise for defenders.
- About 160 TeamCity servers remain unpatched, according to Shadowserver, leaving them vulnerable to ransomware attacks.
YubiKey 5C NFC Security Key — With CI/CD servers like TeamCity under active exploitation, hardening authentication for admin and developer accounts is critical. A hardware security key like the YubiKey adds phishing-resistant multi-factor authentication to protect credentials from being stolen and reused by ransomware operators. It's a simple, practical step any dev team can take to reduce exposure to server compromise incidents like this one.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-24
Published there as: “CISA: Ransomware gangs now exploiting critical TeamCity flaw”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.