{"id":"jetbrains-teamcity-ransomware-attacks-jul-2026","category":"patch","status":"closed","title":"JetBrains TeamCity CVE-2026-63077 exploited in ransomware attacks; fixes available","tldr":"Attackers, including ransomware gangs, exploit TeamCity servers without signing in. Update self-hosted servers to 2026.1.3 or 2025.11.7 or later, and investigate possible compromise. Former Cadence users must rotate exposed credentials.","summary":"CVE-2026-63077 is a critical flaw in JetBrains TeamCity, which businesses use to build and release software. A reachable, unpatched server can accept malicious data through its build-agent communications and run an attacker's commands without a login. This can expose stored credentials and undermine software builds. JetBrains fixed both supported branches in 2026.1.3 and 2025.11.7, and offers a security patch plugin for versions from 2017.1 onwards. TeamCity Cloud customers need no action. CISA listed the flaw as exploited on 5 August; BleepingComputer dates its ransomware flag to 23 September. JetBrains also confirmed exploitation of its unpatched Cadence service, with personal data stolen and source code and credentials potentially exposed. That investigation concluded on 3 September, and affected users were contacted. As at 3 November, fixes are available, but unpatched servers remain exposed; the reviewed sources do not establish that attacks have ended.","action":"Nothing to update on ordinary family devices: this affects business software-building servers. If your business uses TeamCity, ask IT to install 2026.1.3 or 2025.11.7 or a later release, restrict access until patched, and investigate possible compromise using JetBrains' guidance. If you used Cadence, revoke and replace credentials used there and review connected systems for suspicious activity.","product":"JetBrains TeamCity On-Premises","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-63077"],"tags":["jetbrains","teamcity","remote-code-execution","ransomware","actively-exploited"],"affected":["TeamCity On-Premises 2026.1 versions before 2026.1.3 without the security patch plugin","TeamCity On-Premises 2025.11 versions before 2025.11.7 and earlier releases without the security patch plugin"],"fixed":["TeamCity On-Premises 2026.1.3","TeamCity On-Premises 2025.11.7","Security patch plugin for TeamCity 2017.1 and later, addressing CVE-2026-63077 only"],"matches":[],"sources":[{"kind":"advisory","title":"Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077)","url":"https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/","by":"JetBrains","date":"2026-07-27"},{"kind":"advisory","title":"CVE-2026-63077: Additional Guidance Following Reports of Active Exploitation","url":"https://blog.jetbrains.com/teamcity/2026/08/cve-2026-63077-update/","by":"JetBrains","date":"2026-08-07"},{"kind":"post","title":"TeamCity 2026.1.3 and 2025.11.7 Are Now Available","url":"https://blog.jetbrains.com/teamcity/2026/07/teamcity-2026-1-3-2025-11-7-bugfix/","by":"JetBrains","date":"2026-07-25"},{"kind":"advisory","title":"Security Incident Affecting JetBrains Cadence","url":"https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/","by":"JetBrains","date":"2026-09-03"},{"kind":"advisory","title":"JetBrains Releases Security Advisory for Critical Vulnerability CVE-2026-63077","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4826","by":"NHS England","date":"2026-08-07"},{"kind":"news","title":"CISA: Ransomware gangs now exploiting critical TeamCity flaw","url":"https://www.bleepingcomputer.com/news/security/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/","by":"BleepingComputer","date":"2026-09-24"}],"started":"2026-08-05","closed":"2026-09-23","created":"2026-11-03T22:05:03.900Z","updated":"2026-11-03T22:05:03.900Z","cve_notes":[{"cve":"CVE-2026-63077","name":"Unauthenticated code execution in TeamCity agent polling","what":"Unsafe processing of untrusted data in TeamCity's agent polling protocol lets an attacker who can reach the server run operating system commands with the TeamCity process's privileges without signing in.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-09-23","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"CISA updated the catalogue entry to flag known ransomware use, according to BleepingComputer's 24 September report. The agency had not published details of those attacks.","url":"https://www.bleepingcomputer.com/news/security/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/","by":"BleepingComputer","patch":null},{"at":"2026-09-03T17:00Z","added":"2026-11-03T22:00:26.134Z","kind":"vendor-revised","text":"JetBrains concluded its Cadence investigation and said current users' email addresses, source code and credentials in connected storage must also be treated as potentially exposed. Affected users had been contacted; no additional users were identified.","url":"https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/","by":"JetBrains","patch":null},{"at":"2026-08-28","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"JetBrains disclosed that its Cadence service had been exploited through the flaw during 8–24 August after its server missed patching. It took the server offline on 24 August, invalidated connection tokens and warned users to rotate credentials.","url":"https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/","by":"JetBrains","patch":null},{"at":"2026-08-07","added":"2026-11-03T22:00:26.134Z","kind":"vendor-revised","text":"JetBrains confirmed reports of successful and attempted exploitation against unpatched servers. It published investigation guidance and advised restricting external access if a fix could not be applied immediately.","url":"https://blog.jetbrains.com/teamcity/2026/08/cve-2026-63077-update/","by":"JetBrains","patch":null},{"at":"2026-08-05","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalogue and gave US federal agencies until 8 August to remediate it.","url":"https://www.bleepingcomputer.com/news/security/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/","by":"BleepingComputer","patch":null},{"at":"2026-07-27","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"JetBrains publicly disclosed CVE-2026-63077 and provided a security patch plugin for TeamCity 2017.1 and later. It said it was then unaware of active exploitation; TeamCity Cloud had already been protected.","url":"https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/","by":"JetBrains","patch":null},{"at":"2026-07-25","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"JetBrains released TeamCity 2025.11.7 and 2026.1.3 with fixes, according to BleepingComputer's later account.","url":"https://www.bleepingcomputer.com/news/security/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/","by":"BleepingComputer","patch":"patched"},{"at":"2026-07-10","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Antoni Tremblay privately reported the vulnerability to JetBrains.","url":"https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/","by":"JetBrains","patch":"none"}],"url":"https://hard.fyi/live/jetbrains-teamcity-ransomware-attacks-jul-2026/","json":"https://hard.fyi/api/live?id=jetbrains-teamcity-ransomware-attacks-jul-2026"}