CISA: Ransomware gangs now exploiting critical TeamCity flaw

CISA has updated its Known Exploited Vulnerabilities catalog to flag CVE-2026-63077, a critical authentication bypass in JetBrains TeamCity On-Premises, as now being leveraged by ransomware operators. JetBrains fixed the bug on July 25 in versions 2025.11.7 and 2026.1.3; it allows an unauthenticated attacker to abuse the agent polling protocol to run arbitrary OS commands with the TeamCity server's privileges, potentially exposing credentials and compromising CI/CD pipelines. CISA first added the flaw to its exploited-vulnerabilities list back on August 5, and JetBrains confirmed in-the-wild attacks two days later, but this is the first time the ransomware angle has been officially confirmed. Shadowserver currently counts around 160 internet-facing TeamCity instances still unpatched, down from roughly 700 shortly after disclosure, and organizations running exposed servers are urged to apply the fix immediately given TeamCity's history of abuse by both state-sponsored actors and ransomware crews.