CISA warns JetBrains TeamCity RCE exploited in ransomware campaigns

September 24, 2026 at 11:55 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

CISA warned on Sept. 23 that a critical remote code execution flaw in JetBrains TeamCity is under active exploitation by ransomware groups. The vulnerability, CVE-2026-63077 with a CVSS score of 9.8, was patched on July 25 and added to CISA's Known Exploited Vulnerabilities catalog on Aug. 5. Security experts say the flaw allows unauthenticated attackers to compromise build servers and pivot into downstream software supply chains.

Key Facts

CISA warned on Sept. 23 that CVE-2026-63077, a critical RCE flaw in JetBrains TeamCity with a CVSS score of 9.8, is being exploited in ransomware campaigns.
The vulnerability was patched on July 25 and added to CISA's Known Exploited Vulnerabilities catalog on Aug. 5, 2026.
The flaw is an unauthenticated RCE via the agent polling protocol, classified as CWE-502, requiring no credentials for exploitation.
Seemant Sehgal, CEO of BreachLock, advises security teams to treat this as an active compromise scenario until patching, credential rotation, and build log review are completed.
Adrian Culley of SafeBreach notes that TeamCity holds build credentials and signing material, making compromise a potential foothold into every downstream build.

Vulnerability Details

CVE-2026-63077 is a critical remote code execution vulnerability in JetBrains TeamCity with a CVSS score of 9.8. The flaw was patched on July 25, 2026, and added to CISA's Known Exploited Vulnerabilities catalog on Aug. 5, 2026. Adrian Culley, offensive security engineer at SafeBreach, described the bug as an unauthenticated RCE via the agent polling protocol, classified as CWE-502. An attacker with network access to the server needs no credentials to exploit the vulnerability.

Ransomware Exploitation

CISA warned on Sept. 23 that the vulnerability is under active exploitation in ransomware campaigns. The time from disclosure to ransomware exploitation was approximately two months. Seemant Sehgal, CEO of BreachLock, said ransomware groups have identified build servers as high-value targets. Attackers can inject malicious code into legitimate builds, steal signing keys and cloud credentials, and pivot into production infrastructure.

Security Recommendations

Sehgal advises security teams to treat this as an active compromise scenario until the patch is applied, credentials and tokens are rotated, and build logs are reviewed. Patching alone leaves attacker access from the pre-patch window in place, a step teams sometimes miss on compressed timelines. Culley emphasized that organizations should test whether their detection stack catches exploitation of an internet-facing build server before it pivots downstream. Boris Cipot, principal security engineer at Black Duck, expressed concern about how quickly vulnerabilities in critical development infrastructure move from disclosure to real-world exploitation.