Ransomware Is Still Hitting TeamCity: CVSS 9.8 Flaw Puts Build Pipelines at Risk

If your organisation runs JetBrains TeamCity On-Premises and hasn't patched since July, ransomware gangs have likely already tried to walk in through CVE-2026-63077, a critical unauthenticated RCE flaw that CISA confirmed as actively exploited two months ago.

The vulnerability, rated CVSS 9.8, sits in the agent polling endpoint and exploits improper deserialisation of untrusted data. No authentication required, no user interaction needed. An attacker sends a crafted HTTP request to your TeamCity server and gets full remote code execution as the TeamCity service account. Tech Insider reported this week that ransomware groups have continued targeting unpatched instances, with JetBrains' own infrastructure breached in September after credentials from an earlier attack were reused.

Why This Is Worse Than a Typical Server Compromise

TeamCity isn't just another server. It sits at the centre of your software delivery pipeline, holding build secrets, cloud API keys, deployment credentials, and source code access. Compromise it and the attacker owns everything downstream. For Australian businesses using TeamCity to automate deployments into cloud environments or client infrastructure, that means one unpatched server can cascade into a full supply chain incident.

Managed service providers running shared TeamCity instances face the sharpest exposure: one breached server can hand attackers access to build jobs and credentials spanning every client environment connected through it. This is not theoretical. CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalogue in August, with an eight-day remediation deadline for federal agencies. That clock applies to the private sector too, in practice.

What to Do Right Now

• Upgrade immediately. Patch to TeamCity 2025.11.7 or 2026.1.3. JetBrains also released a security patch plugin for users on version 2017.1 or later who can't do a full upgrade right now.
• Rotate every secret the server touched. API keys, cloud credentials, deployment tokens: all of them. If the server ran unpatched while exploitation was active, treat those secrets as compromised.
• Restrict network access. TeamCity should not be internet-facing. Put it behind a VPN or firewall and enforce MFA on all console access.
• Audit build logs and agent connections. Look for unfamiliar agents, unexpected script executions, or new user accounts, especially any with a .invalid email suffix, which is a known indicator from previous RMM-targeting campaigns.

TeamCity Cloud users require no action. This flaw affects self-hosted On-Premises installations only. If you're unsure which version your organisation runs, that's your first task.

How All IT Handles Vulnerability Management for Clients

All IT monitors CISA's Known Exploited Vulnerabilities catalogue and vendor security advisories as part of ongoing managed services for clients in Sydney, the Northern Beaches, Central West NSW, and beyond. When a critical CVE like this surfaces, we assess client exposure, push patching where it applies, and confirm remediation, rather than waiting for a quarterly review cycle. If your current IT setup doesn't include proactive patch tracking, that's a gap worth closing before the next CVSS 9.8 lands.