NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

JetBrains TeamCity CVE-2026-63077 exploited in ransomware attacks; fixes available

Attackers, including ransomware gangs, exploit TeamCity servers without signing in. Update self-hosted servers to 2026.1.3 or 2025.11.7 or later, and investigate possible compromise. Former Cadence users must rotate exposed credentials.

What to do

Nothing to update on ordinary family devices: this affects business software-building servers. If your business uses TeamCity, ask IT to install 2026.1.3 or 2025.11.7 or a later release, restrict access until patched, and investigate possible compromise using JetBrains' guidance. If you used Cadence, revoke and replace credentials used there and review connected systems for suspicious activity.

What’s happening

CVE-2026-63077 is a critical flaw in JetBrains TeamCity, which businesses use to build and release software. A reachable, unpatched server can accept malicious data through its build-agent communications and run an attacker's commands without a login. This can expose stored credentials and undermine software builds. JetBrains fixed both supported branches in 2026.1.3 and 2025.11.7, and offers a security patch plugin for versions from 2017.1 onwards. TeamCity Cloud customers need no action. CISA listed the flaw as exploited on 5 August; BleepingComputer dates its ransomware flag to 23 September. JetBrains also confirmed exploitation of its unpatched Cadence service, with personal data stolen and source code and credentials potentially exposed. That investigation concluded on 3 September, and affected users were contacted. As at 3 November, fixes are available, but unpatched servers remain exposed; the reviewed sources do not establish that attacks have ended.

What
Flaw
Affects
JetBrains TeamCity On-Premises
Affected
TeamCity On-Premises 2026.1 versions before 2026.1.3 without the security patch plugin
TeamCity On-Premises 2025.11 versions before 2025.11.7 and earlier releases without the security patch plugin
Fixed in
TeamCity On-Premises 2026.1.3
TeamCity On-Premises 2025.11.7
Security patch plugin for TeamCity 2017.1 and later, addressing CVE-2026-63077 only
CVE
CVE-2026-63077
Since
5 Aug 2026
Closed
23 Sept 2026

Timeline

  1. Wider attacks

    CISA updated the catalogue entry to flag known ransomware use, according to BleepingComputer's 24 September report. The agency had not published details of those attacks.

  2. Vendor revised

    JetBrains concluded its Cadence investigation and said current users' email addresses, source code and credentials in connected storage must also be treated as potentially exposed. Affected users had been contacted; no additional users were identified.

  3. Wider attacks

    JetBrains disclosed that its Cadence service had been exploited through the flaw during 8–24 August after its server missed patching. It took the server offline on 24 August, invalidated connection tokens and warned users to rotate credentials.

  4. Vendor revised

    JetBrains confirmed reports of successful and attempted exploitation against unpatched servers. It published investigation guidance and advised restricting external access if a fix could not be applied immediately.

  5. CISA added

    CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalogue and gave US federal agencies until 8 August to remediate it.

  6. Made public

    JetBrains publicly disclosed CVE-2026-63077 and provided a security patch plugin for TeamCity 2017.1 and later. It said it was then unaware of active exploitation; TeamCity Cloud had already been protected.

  7. New fixFixed

    JetBrains released TeamCity 2025.11.7 and 2026.1.3 with fixes, according to BleepingComputer's later account.

  8. UpdateNo fix yet

    Antoni Tremblay privately reported the vulnerability to JetBrains.

Sources

  1. Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077)JetBrains · 27 July 2026
  2. CVE-2026-63077: Additional Guidance Following Reports of Active ExploitationJetBrains · 7 Aug 2026
  3. TeamCity 2026.1.3 and 2025.11.7 Are Now AvailableJetBrains · 25 July 2026
  4. Security Incident Affecting JetBrains CadenceJetBrains · 3 Sept 2026
  5. JetBrains Releases Security Advisory for Critical Vulnerability CVE-2026-63077NHS England · 7 Aug 2026
  6. CISA: Ransomware gangs now exploiting critical TeamCity flawBleepingComputer · 24 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS