Cybersecurity
CISA says ransomware gangs exploited TeamCity flaw
CISA told federal agencies that ransomware groups were exploiting a TeamCity vulnerability patched by JetBrains in July, after the flaw was added to CISA's active-exploitation list and linked to exposed servers.
- CISA warned federal agencies that ransomware gangs were using a TeamCity vulnerability that JetBrains had patched in July.
- JetBrains said the flaw, tracked as CVE-2026-63077, affected TeamCity On-Premises versions 2025.11.7 and 2026.1.3.
- CISA added the flaw to its list of actively exploited vulnerabilities on 5 August and gave federal agencies three days to secure their networks.
- JetBrains said on 7 August that it had confirmed exploitation in the wild and had shared indicators of compromise.
- Shadowserver was tracking just over 160 unpatched TeamCity servers, down from about 700 internet-exposed servers seen after the patch.
CISA told federal agencies on Wednesday that ransomware gangs were exploiting a TeamCity flaw that JetBrains had patched on 25 July. The issue was identified as CVE-2026-63077.
JetBrains said the bug affected TeamCity On-Premises versions 2025.11.7 and 2026.1.3. It said the flaw could let an unauthenticated attacker bypass checks and run operating system commands through HTTP(S) access.
CISA added the CVE to its list of actively exploited vulnerabilities on 5 August and ordered federal agencies to secure their networks within three days. JetBrains said on 7 August that it had confirmed real-world exploitation and had shared indicators of compromise.
Shadowserver said it was tracking just over 160 TeamCity servers that had not been patched, down from about 700 internet-facing servers seen after the fix was released. The article also said TeamCity was a CI/CD platform, and it cited a 2024 warning about APT29 targeting TeamCity and Zimbra servers, linking APT29 to Russia's Foreign Intelligence Service (SVR).
Named in this story
Companies
- JetBrains
- patched the flaw and later said it had been used in the wild
Organisations
- Shadowserver
- tracked unpatched TeamCity servers
- APT29
- was cited in a prior warning about targeting TeamCity and Zimbra servers
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency (CISA)
- warned federal agencies and added the flaw to its exploited-vulnerabilities list
- Russia's Foreign Intelligence Service (SVR)
- was the service APT29 was linked to
Products and systems
- CVE-2026-63077
- was the identifier for the TeamCity vulnerability
- TeamCity On-Premises
- was the affected software line
- TeamCity
- was described as JetBrains's CI/CD platform
How the source tells it
The piece was written in a straight cyber-alert register, with urgency coming from the active-exploitation warning and the repeated calls to patch exposed systems.
- urgency the warning, deadline and immediate-patch language press the reader towards quick action