TeamCity authentication-bypass flaw now linked to ransomware abuse
SecurityUnverifiedUpdated:
Ransomware use has reportedly been added to the threat information for TeamCity flaw CVE-2026-63077. The authentication-bypass flaw was patched in July and listed as actively exploited in August.
Ransomware use reported for a flaw patched in July
BleepingComputer reported that CISA updated its Known Exploited Vulnerabilities Catalog to flag CVE-2026-63077 as abused by ransomware gangs. JetBrains patched the critical flaw on July 25 in TeamCity On-Premises versions 2025.11.7 and 2026.1.3. The vulnerability can allow an unauthenticated attacker with HTTP(S) access to bypass authentication through the TeamCity agent polling protocol and run operating-system commands with the TeamCity server process’s privileges.
The supplied report says CISA had already listed CVE-2026-63077 as actively exploited in August; it does not provide a comparable earlier assessment of ransomware use.
CISA has now flagged the TeamCity flaw as being abused by ransomware gangs, according to the report.
The reported update changes the stated threat status from active exploitation to ransomware-linked exploitation for a flaw in TeamCity, a CI/CD platform used to automate software building, testing, and deployment.
Sources
- BleepingComputerCISA: Ransomware gangs now exploiting critical TeamCity flawRead source →