Security1 publisher2 min readPublished
Ransomware gangs are now exploiting the TeamCity bypass JetBrains patched on July 25, CISA says
JetBrains fixed the authentication bypass on July 25 and CISA gave federal agencies until August 8 to apply it. Shadowserver still counts just over 160 exposed servers, and the KEV entry now flags ransomware use.
The Watch · Security desk
What happened
- CISA told federal agencies on Wednesday that ransomware gangs are now exploiting a critical JetBrains TeamCity vulnerability that was patched back in July.
- The bug, CVE-2026-63077, was fixed on July 25 in TeamCity On-Premises 2025.11.7 and 2026.1.3, and lets an attacker with HTTP(S) access run arbitrary operating system commands.
- CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 5 and gave federal agencies three days to secure their networks.
- JetBrains confirmed exploitation in the wild on August 7, published indicators of compromise, and told customers who could not patch to restrict server access to trusted networks.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure By JetBrains' own description of the impact, a hit reaches stored credentials, server state and build artifacts, so recovery on one of those 160 servers includes reviewing what the pipeline shipped downstream, not just rebuilding a host.
- decision For anyone still exposed, there are two options on the record: apply 2025.11.7 or 2026.1.3, or fence the agent polling protocol behind trusted networks as JetBrains advised on August 7.
- constraint For now, hunting for these intrusions means working from the indicators JetBrains published.
- precedent The same class of exposed build server that drew SVR-linked scanning in 2024 now draws extortion crews. The next TeamCity pre-auth bug will be triaged on that assumption.
The exploit path is the agent polling protocol, the channel build agents use to reach the server, and it needs no account on the box. JetBrains said "An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process" [3].
On scope, JetBrains said a successful attack "could expose TeamCity data, configurations, and stored credentials, modify server state, and potentially compromise the integrity of build artifacts and downstream CI/CD pipelines" [4]. TeamCity exists to automate building, testing and deploying code [10], so the stored credentials in that sentence are the ones that run deployments.
CISA listed the CVE as actively exploited 11 days after the July 25 patch [13]. The three-day order set the federal deadline at August 8, and JetBrains' confirmation of exploitation in the wild landed on August 7, one day inside that window [14].
Shadowserver's count has gone from 700 internet-exposed vulnerable servers to just over 160, a drop of about 540, or 77 percent [12]. The 160 that remain have stayed unpatched since before the indicators of compromise went out on August 7 [8][6]. JetBrains says more than 30,000 DevOps teams use TeamCity [11]; that figure counts teams, while Shadowserver counts servers a scanner can find.
CISA's Wednesday update changed the ransomware field in the KEV entry, and the agency has not published details of the attacks or named an operator [7]. TeamCity has drawn state-backed attention before: in October 2024, US and UK cyber agencies warned that APT29, linked to Russia's Foreign Intelligence Service, was targeting vulnerable TeamCity and Zimbra servers "at a mass scale" [9]. Those were different flaws. For CVE-2026-63077, what is public is exploitation since early August and a ransomware label as of Wednesday [15].
What to watch
- Whether CISA or JetBrains names the ransomware operators or publishes attack detail beyond the August 7 indicators.