What Happened

CISA confirmed on September 23, 2026, that ransomware crews are actively exploiting CVE-2026-63077, a critical remote-code-execution vulnerability in JetBrains TeamCity with a CVSS score of 9.8. The flaw allows an unauthenticated attacker with network access to execute arbitrary OS commands on the TeamCity server. JetBrains shipped a fix on July 25, 2026, but exploitation continued. In early September, attackers used this vulnerability to breach JetBrains' own Cadence environment and extract AWS credentials.

Who Is Affected

All organizations running TeamCity On-Premises versions up to 2025.11.6 and 2026.1.2 are affected. Cloud-hosted TeamCity customers are not impacted because JetBrains patches centrally. TeamCity is used by over 30,000 development teams worldwide, making this a widespread risk for enterprises with CI/CD pipelines that hold cloud credentials and signing keys.

Market Impact

• Immediate need for patch management and vulnerability scanning solutions targeting TeamCity instances.
• Increased demand for CI/CD security tools that detect and block exploitation of build pipeline vulnerabilities.
• Cloud posture management solutions needed to audit and rotate credentials exposed via compromised TeamCity servers.
• Ransomware operators are shifting focus to build servers as force multipliers, driving urgency for lateral movement detection and zero-trust segmentation.

What to Watch

Monitor for additional ransomware groups adopting this exploit, as CISA's advisory did not name a specific group. Expect downstream breaches from compromised TeamCity instances as attackers pivot to cloud accounts. Security vendors should track which accounts have unpatched TeamCity servers and prepare for CISA to issue further guidance or remediation deadlines.

Related coverage

• CISA Confirms Critical Zero-Day Exploits in Citrix NetScaler ADC and Gateway
• Data breach at IDScan.net may have exposed 150M+ driver's license images
• Telus Warns Customers of Account Breaches
• Manchester Airports Group breach: FulcrumSec claims 86GB data theft after MAG discloses 8.7M customer breach