Ransomware Exploits TeamCity RCE Flaw CVE-2026-63077
CISA: Ransomware Gangs Actively Exploiting Critical TeamCity RCE Flaw
Related Entities
CVE Identifiers
Full Report
Executive Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that multiple ransomware groups are actively exploiting a critical vulnerability in JetBrains TeamCity On-Premises servers. The vulnerability, tracked as CVE-2026-63077, has a CVSS score of 9.8 (Critical) and allows an unauthenticated attacker to achieve remote code execution (RCE). This provides a direct path to compromising CI/CD pipelines, representing a significant software supply chain threat. The flaw was added to CISA's Known Exploited Vulnerabilities (KEV) catalog in August 2026, and the latest warning on September 23rd specifically attributes active exploitation to ransomware campaigns, demanding immediate remediation from all organizations using the affected software.
Vulnerability Details
- CVE ID: CVE-2026-63077
- CVSS Score: 9.8 (Critical)
- Vulnerability Type: Deserialization of Untrusted Data
- Attack Vector: Network
- Privileges Required: None
- User Interaction: None
The vulnerability exists in the TeamCity agent polling protocol. An unauthenticated attacker with network access to the TeamCity server can send a specially crafted request, leading to a deserialization flaw that results in arbitrary command execution with the permissions of the TeamCity server process.
Affected Systems
- JetBrains TeamCity On-Premises: All versions before
2025.11.7and2026.1.3are vulnerable.
JetBrains released patches on July 25, 2026. TeamCity Cloud is not affected.
Exploitation Status
Exploitation of CVE-2026-63077 began shortly after its disclosure. CISA added the vulnerability to its KEV catalog on August 5, 2026. The most recent advisory from September 23, 2026, explicitly states that ransomware gangs have incorporated the exploit into their attack chains. The Shadowserver Foundation reported that as of late September, over 160 unpatched TeamCity servers remained exposed to the internet, making them prime targets.
Impact Assessment
Compromising a TeamCity server is a high-impact event that creates a critical software supply chain risk. An attacker with control over a CI/CD server can:
- Inject Malicious Code: Insert backdoors, malware, or vulnerabilities into the software being built, which then gets distributed to downstream users. This is a classic supply chain attack, as seen with SolarWinds.
- Steal Credentials and Secrets: Exfiltrate source code, API keys, cloud credentials, and code-signing certificates that are stored on or accessed by the build server.
- Deploy Ransomware: Use the compromised server as a beachhead to pivot into the corporate network and deploy ransomware across the environment.
- Disrupt Development: Halt all software development and deployment operations, causing significant business interruption.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised TeamCity systems:
8111/app/rest/agentsjava.execmd.exe, powershell.exe, or bash.<TeamCity_Data_Directory>/logs/teamcity-server.logDetection Methods
- Process Monitoring: Use an EDR solution to monitor the TeamCity server process (typically
java.exe) for any anomalous child process creation. The server should not be spawning interactive shells or reconnaissance tools. - Network Analysis: Analyze network traffic from the TeamCity server. Alert on connections to known malicious IP addresses, Tor exit nodes, or unexpected outbound connections to cloud storage providers. This is an application of
D3-NTA: Network Traffic Analysis. - Build Integrity Checks: After patching, review recent build configurations and artifacts for any unauthorized modifications. Re-verify the integrity of all build scripts and dependencies.
Remediation Steps
- Patch Immediately: Upgrade all TeamCity On-Premises instances to a patched version (
2025.11.7,2026.1.3, or newer) without delay. This is the most critical step. - Assume Compromise: If your server was exposed and unpatched, assume it was compromised. Rotate all secrets, credentials, API keys, and certificates stored on the server or accessible to it.
- Restrict Access: Do not expose TeamCity servers directly to the internet. Place them behind a VPN or firewall and restrict access to trusted IP addresses. This is a form of
D3-NI: Network Isolation. - Review Audit Logs: Scrutinize audit logs for any unauthorized changes to projects, build configurations, or user permissions.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
The primary mitigation is to update TeamCity to a patched version to eliminate the vulnerability.
Restrict network access to the TeamCity server, placing it behind a firewall or VPN and limiting access to only authorized IP addresses.
Privileged Account Management
Regularly audit and rotate all credentials, secrets, and API keys that are stored on or used by the TeamCity server.
D3FEND Defensive Countermeasures
The most urgent and effective action is to immediately upgrade all vulnerable JetBrains TeamCity On-Premises instances to a patched version (2025.11.7, 2026.1.3, or newer). Given that ransomware groups are actively exploiting this CVSS 9.8 vulnerability, this is not a routine update; it is an emergency change. Organizations should invoke their emergency patching procedures to deploy this fix without delay. After patching, it is crucial to verify the update was successful across all instances and then proceed with hunting for signs of prior compromise, as attackers may have gained access before the patch was applied.
Deploy EDR or use native OS logging (like Windows Event ID 4688 with command-line logging enabled) to scrutinize the process activity on TeamCity servers. The TeamCity server's Java process should have a very predictable set of child processes. Any deviation from this baseline is highly suspicious. Specifically, create detection rules to alert if the java.exe process associated with TeamCity spawns shells (cmd.exe, powershell.exe, bash), network reconnaissance tools (ipconfig, netstat), or script interpreters. This is a high-fidelity way to detect post-exploitation activity resulting from the CVE-2026-63077 RCE.
Beyond patching, organizations should harden their TeamCity configurations. A critical step is to rotate all secrets and credentials that the CI/CD server has access to, as these must be considered compromised on any unpatched server. This includes VCS roots credentials, cloud provider access keys, and any secrets used in build steps. Furthermore, review all build projects for any unauthorized changes to build scripts or configurations. Attackers who gained access via CVE-2026-63077 may have established persistence by modifying a build process to inject malicious code or create a backdoor, which would survive the patching of the initial vulnerability.
Timeline of Events
JetBrains releases patches for CVE-2026-63077 in versions 2025.11.7 and 2026.1.3.
CISA adds CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog.
CISA issues a warning that ransomware groups are actively exploiting the TeamCity vulnerability.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.