Ransomware crews now target TeamCity — patch your build server

By George Bailey   Published: 09/25/26   5 min read
Cybersecurity

Your build server touches every release you ship. Ransomware crews now know it too: CISA says they’re using a TeamCity hole that JetBrains fixed back in July.

Just over 160 Internet-facing TeamCity servers still haven’t taken the patch. If one of them is yours, it’s Friday’s first job.

Own the build server and you own every release that comes out of it.

What happened

CVE-2026-63077 is a critical flaw in JetBrains TeamCity On-Premises. Anyone who can reach the server over HTTP(S) can abuse the agent polling protocol to skip authentication and run operating system commands as the TeamCity server process. No login needed.

JetBrains fixed it in TeamCity 2025.11.7 and 2026.1.3 (advisory dated July 27, 2026) and shipped a security patch plugin for 2017.1 and later. TeamCity Cloud needs no action.

CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog on August 5, and JetBrains confirmed attacks on August 7. On Wednesday, September 23, CISA updated the entry to known use in ransomware campaigns. The entry also requires forensic triage under BOD 26-04: federal agencies must check whether they were breached before patching, not just patch.

Shadowserver’s count of unpatched, exposed servers has dropped from about 700 right after the fix to just over 160, per BleepingComputer. That long tail is what ransomware crews shop for.

Why it matters

A CI/CD server holds the keys: source-control tokens, cloud deploy credentials, signing material, and the artifacts customers install. JetBrains warns a successful attack can expose stored credentials and “compromise the integrity of build artifacts and downstream CI/CD pipelines.” For a ransomware crew, that’s a foothold and leverage in one box. It’s also why software supply chain security tools now treat the build system as production.

This is a pattern, not a one-off. CISA has tagged four TeamCity flaws as exploited since October 2023, and all four have been used in ransomware attacks. In October 2024, U.S. and U.K. agencies warned that Russia’s APT29 was hitting TeamCity servers at mass scale. Ransomware crews made the same move on vCenter’s syslog bug last week: once a patch is public, the stragglers become the target list.

What to do first

  1. Patch. Upgrade TeamCity On-Premises to 2025.11.7 or 2026.1.3 (or later). If you can’t today, install JetBrains’ security patch plugin (2017.1+; on 2024.03+ it’s under Administration › Updates).
  2. Get it off the open Internet. If an unpatched server is reachable from outside, put it behind a VPN or allowlist now. JetBrains recommends restricting external access until you patch.
  3. Check the logs. Search server logs for com.thoughtworks.xstream.converters.ConversionException, a possible attempt or success.
  4. Check the agents. Review unauthorized build agents for unexpected entries, especially names starting with scan.
  5. If anything looks off, treat it as an incident. That includes a server that sat exposed and unpatched after late July. Rotate every credential TeamCity stores (source control, cloud, registry, signing) and verify recent release artifacts. A privileged access management vault makes that rotation much faster next time.
  6. Longer term: run the server with least OS privilege, on a host separate from build agents.

Forward this

If your team builds or ships software with TeamCity: confirm today that the server is on 2025.11.7 or 2026.1.3 (or has JetBrains’ security patch plugin) and isn’t reachable from the open Internet. If it was exposed and unpatched at any point since late July, treat it as a possible break-in. Rotate the passwords and keys it stores, and check the last few releases before anyone ships again.

Details

Hunt / verify

Slack paste: TeamCity on 2025.11.7 / 2026.1.3 (or patch plugin) today; no Internet exposure; grep logs for ConversionException; remove scan* agents; if exposed since July, rotate stored creds.

FAQ

Is TeamCity Cloud affected by CVE-2026-63077?

No action is needed. JetBrains says the mitigations are already applied to TeamCity Cloud. The risk is self-hosted TeamCity On-Premises.

Is the security patch plugin enough?

It closes this one bug on TeamCity 2017.1 and later. JetBrains still recommends upgrading to a current release to pick up other security fixes.

We patched in August. Are we done?

Only if the server wasn’t exposed and unpatched in the meantime. Attacks were confirmed on August 7, so check the logs and build agents for signs of earlier compromise.

Build-server and CI/CD risks like this land in the CyberExperts Daily Brief each weekday morning, in five minutes, with what to patch first.

Sources

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.