JetBrains TeamCity CVE-2026-63077 ransomware exploitation

Quick summary — why you should act right now

Confirmed fact: ransomware gangs are exploiting CVE-2026-63077 against TeamCity servers in the wild, according to U.S. federal reporting summarized by security outlets [1].

Official announcement: JetBrains released fixes in versions 2026.1.3 and 2025.11.7 addressing the vulnerability; those releases were published on July 27, 2026 [2].

Independent analysis: Rapid7 published technical analysis showing the vulnerability is an unauthenticated RCE that allows code execution without valid credentials, which makes internet‑reachable instances particularly dangerous [3].

What is CVE-2026-63077 and how severe is it?

CVE-2026-63077 is an unauthenticated remote code execution vulnerability in JetBrains TeamCity. An attacker can trigger code execution without logging in, which can let them run arbitrary commands or drop malware on an affected server [3]. This type of bug is high severity because it bypasses normal access controls.

As of this writing (2026-09-26) U.S. federal authorities and multiple security outlets have confirmed active exploitation by ransomware groups, raising the urgency for organizations with on‑prem TeamCity instances to respond immediately [1][3].

Confirmed reporting vs. official fixes vs. analysis

• Confirmed reporting: CISA added CVE-2026-63077 to its notifications after observing active exploitation by ransomware actors, as reported by security media [1].
• Official fixes: JetBrains issued patched TeamCity builds: 2026.1.3 and 2025.11.7; JetBrains’ blog post lists the releases and recommends upgrades [2].
• Independent analysis: Rapid7 published a technical breakdown describing how the unauthenticated RCE can be triggered and suggests detection and mitigation steps for defenders [3].

What this means in plain terms

If your TeamCity server is reachable from untrusted networks (for example, directly on the public internet or over insufficiently restricted VPN access), an attacker may be able to seize the server, move laterally into build agents or artifact stores, and deploy ransomware or other malware. Because CI/CD environments often have access to credentials, build artifacts, and internal systems, compromise can have outsized impact on development and production environments.

Immediate actions for small businesses and DevOps teams

The following steps prioritize speed and containment. Label each as either “patch required” (best) or “temporary mitigation” (use if you cannot patch immediately).

• Patch required — update TeamCity now. Install JetBrains TeamCity 2026.1.3 or 2025.11.7 (whichever branch you run). JetBrains published those releases to address this RCE [2]. Patching is the definitive fix.
• Temporary mitigation — restrict network exposure. If you cannot patch immediately, block external access to TeamCity at the network perimeter. Remove public DNS records and firewall off ports to make the server accessible only from trusted internal networks or a hardened VPN.
• Temporary mitigation — enforce access controls. Require multi-factor authentication (MFA) on any jump hosts and limit who can log into build servers. While CVE-2026-63077 is unauthenticated, reducing accessible attack surface helps limit follow-on impact.
• Containment — isolate suspicious systems. If you detect compromise, isolate the affected host(s) from the network, preserve logs and disk images, and engage incident response or an external forensics provider.
• Credentials — rotate secrets. Assume credentials used by build agents or stored in TeamCity may be exposed. Rotate API keys, service account passwords, and deploy tokens used by CI pipelines after removing the attacker.
• Backups and rebuilds. Confirm backups of critical artifacts and configuration. In case of ransomware or covert persistence, plan to rebuild compromised machines from known-good images rather than trusting live systems.

Detection and indicators of compromise (IOC)

Confirmed and independent sources describe broad detection guidance; consult Rapid7 for technical indicators [3]. In short, look for:

• Unusual processes started by the TeamCity process user or root on build nodes.
• Unexpected file drops in build agent directories and artifact storage.
• New or unexpected service accounts, SSH keys, or scheduled tasks created around the time of suspicious activity.
• Large outbound connections or data transfers from TeamCity servers to unfamiliar IPs, especially to known malicious infrastructure.
• Anomalous build jobs that run commands you did not configure.

For high confidence detection, forward TeamCity, system, and network logs to a centralized SIEM and search for signs above. Rapid7’s writeup includes additional technical details useful to SOC teams and forensic analysts [3].

If you are already compromised

Confirmed fact: ransomware groups are exploiting the defect in the wild, which means active compromise is possible and has been observed [1]. If you suspect an active breach:

1. Immediately isolate the server from the network.
2. Preserve logs, memory captures, and disk images for forensic analysis.
3. Do not attempt to restore from backups before ensuring backups are not also compromised.
4. Engage legal and compliance teams; follow any sector-specific breach notification rules.
5. Consider hiring external incident response specialists if you lack in‑house capabilities.

Which TeamCity versions are safe?

Official: JetBrains’ release notes show the fixes are in TeamCity 2026.1.3 and 2025.11.7; upgrade to these or later builds to remediate the vulnerability [2].

Who should upgrade, who can wait, and who should avoid on‑prem TeamCity

• Upgrade immediately: Any organization running on‑prem TeamCity that is reachable from untrusted networks or that stores build secrets, deploy keys, or artifact repositories in CI. These instances have highest risk for ransomware escalation.
• Can wait briefly: Isolated test or development instances that are air-gapped and not authoritative for production builds. Still, schedule patches quickly to avoid drift.
• Consider alternatives / avoid on‑prem: Small teams without dedicated security ops may prefer hosted CI offerings with vendor-managed security, provided those services meet compliance needs and you trust the provider. However, hosted CI is not a panacea; evaluate access controls and secrets handling carefully.

Longer‑term changes DevOps teams should consider

Because CI/CD systems have become high‑value targets, treat them as critical infrastructure. Over time, apply these practices:

• Reduce the privileges of build agents and separate roles for build orchestration, artifact storage, and secrets management.
• Use ephemeral build agents that start from minimal images and do not retain credentials between runs.
• Move secrets to dedicated vaults with short‑lived credentials and strict access controls.
• Monitor supply chain dependencies and enforce reproducible builds to limit risk from compromised artifacts.

Resources and where this reporting came from

Official JetBrains release notes describing the patched TeamCity versions were published by JetBrains on July 27, 2026 (TeamCity 2026.1.3 and 2025.11.7) [2]. Rapid7 provided an independent technical analysis of the unauthenticated RCE, including exploitation details and detection suggestions [3]. U.S. federal reporting and security outlets summarized that ransomware groups are exploiting the flaw in the wild; CISA notifications were reported by security media on September 24, 2026 [1].

Labeling of sources in this article:

• Official announcement: JetBrains release notes and blog post (official vendor) [2].
• Independent analysis: Rapid7 technical writeup (independent security researcher/firm) [3].
• Confirmed reporting: BleepingComputer summary of CISA and observed exploitation (security reporting) [1].

Practical checklist — what to do right now (ordered)

1. Identify all TeamCity instances and note whether they are reachable from the internet.
2. If reachable, immediately block access at the firewall or disconnect the instance from public networks.
3. Patch to JetBrains TeamCity 2026.1.3 or 2025.11.7 now, or schedule emergency maintenance and communicate downtime to stakeholders [2].
4. Inspect logs and artifacts for suspicious activity; escalate to incident response if compromise is suspected [3].
5. Rotate credentials and secrets used by pipelines after confirming systems are clean.
6. Implement long-term hardening: ephemeral agents, least privilege, secrets vaulting, and monitoring.

Final practical note

Do not delay: confirmed reports show active exploitation, and JetBrains has provided patched releases. If you operate on‑prem TeamCity, assume risk until you patch or isolate. For more technical details, consult the Rapid7 analysis and JetBrains release notes linked in our sources below [2][3].

FAQs