CISA Warns Ransomware Gangs Are Exploiting JetBrains TeamCity Flaw

Ransomware gangs are actively exploiting a critical authentication bypass vulnerability in the JetBrains TeamCity platform, according to a warning from the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

The vulnerability, tracked as CVE-2026-63077, was originally patched by JetBrains in July. CISA updated its Known Exploited Vulnerabilities (KEV) catalogue on Wednesday, signalling that the flaw is being leveraged in ongoing ransomware attacks.

Technical Impact on CI/CD Pipelines

The flaw allows an unauthenticated attacker to exploit the TeamCity agent polling protocol to bypass authentication checks. Once the bypass is successful, attackers can execute arbitrary operating system commands with the privileges of the TeamCity server process.

This capability poses a significant risk to the integrity of software development lifecycles. Successful exploitation could allow threat actors to expose stored credentials, access sensitive configurations, and potentially compromise build artifacts or downstream continuous integration and continuous deployment (CI/CD) pipelines.

JetBrains has released security updates to address the issue. Organisations using TeamCity On-Premises should ensure they have updated to versions 2025.11.7 or 2026.1.3.

Widespread Exposure and History of Attacks

TeamCity is a widely utilised CI/CD platform, supporting more than 30,000 DevOps teams at high-profile organisations including Amazon Games, Tesla, and Samsung. Because these platforms sit at the heart of software production, they are high-value targets for both cybercriminals and state-backed actors.

Security watchdog Shadowserver has been monitoring the vulnerability. While the number of internet-exposed, unpatched TeamCity servers has fallen from approximately 700 to just over 160 since the initial patch, the remaining unpatched systems remain highly vulnerable.

This incident follows a pattern of TeamCity vulnerabilities being targeted by advanced threats. Since October 2023, CISA has flagged four separate TeamCity security issues as being exploited in the wild, all of which were subsequently abused in ransomware attacks. In 2024, cyber agencies also warned that Russian-linked state actors, such as APT29, were targeting vulnerable TeamCity servers at scale.