Ransomware operators are exploiting CVE-2026-63077, a critical vulnerability in JetBrains TeamCity On-Premises, according to a September 24 BleepingComputer report on a change to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog. CISA now lists the flaw as known to be used in ransomware campaigns. The agency has not identified an associated group, victim or number of incidents.

TeamCity is a platform for building, testing and deploying software. JetBrains disclosed the flaw in July and released fixes for its self-hosted product. CISA added it to the Known Exploited Vulnerabilities catalog on August 5 after evidence of exploitation emerged; the ransomware designation is the new development reported this week.

CISA describes CVE-2026-63077 as deserialization of untrusted data that can enable unauthenticated remote code execution through TeamCity's agent polling protocol. JetBrains says an attacker who can reach a vulnerable server over HTTP or HTTPS can bypass authentication and run operating system commands with the privileges of the TeamCity server process. No user interaction is required.

The potential damage extends beyond the server. JetBrains warns that successful exploitation could expose stored credentials, configuration and TeamCity data, alter server state and compromise build artifacts or downstream software delivery pipelines. Those outcomes depend on the server process's permissions; CISA's ransomware flag does not establish that every affected deployment suffered those consequences.

JetBrains fixed the issue in TeamCity On-Premises 2025.11.7 and 2026.1.3 and offers a security patch plugin for installations from 2017.1 onward that cannot immediately upgrade. Its advisory says all On-Premises versions were affected before mitigation, while TeamCity Cloud customers need no action for this flaw. CISA calls for vendor-recommended mitigations and forensic triage of exposed systems.

Administrators should verify their TeamCity version or installed patch plugin, restrict server access to trusted networks and examine potentially exposed systems for signs of compromise. JetBrains also recommends running the server with the minimum necessary operating system privileges. CISA's catalog does not provide campaign-specific indicators or identify a ransomware family for this vulnerability, so defenders should avoid treating the catalog entry as a complete account of individual attacks.