TeamCity CI/CD Under Siege: Ransomware Gangs Weaponize Critical RCE CVE-2026-63077
Date: September 27, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Software Supply Chain / Ransomware Defense / Vulnerability Analysis
Tags: JetBrains TeamCity, CVE-2026-63077, CI/CD Security, Ransomware, Remote Code Execution, CISA Alert, Supply Chain
Executive Summary
Continuous Integration and Continuous Delivery (CI/CD) pipelines have become the prime staging ground for enterprise ransomware cartels and state-sponsored espionage syndicates. In an urgent threat briefing updated on September 25–27, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), accompanied by technical reports from Aviatrix and Shattered.io, confirmed that active ransomware operators are aggressively weaponizing CVE-2026-63077—a critical unauthenticated Remote Code Execution (RCE) vulnerability in JetBrains TeamCity On-Premises.
Carrying a maximum severity CVSS v3.1 score of 9.8 (Critical), the vulnerability allows unauthenticated remote attackers who can reach a TeamCity server’s web interface to bypass authentication mechanisms and execute arbitrary system commands with the privileges of the TeamCity service account.
Because CI/CD servers hold privileged access to production environments, proprietary source code repositories, and high-value cloud deployment credentials, compromise of a TeamCity instance provides adversaries with an unprecedented launchpad for software supply chain poisoning, credential harvesting, and network-wide ransomware deployment.
Technical Deep-Dive: Exploiting the CI/CD Pipeline
To understand why ransomware syndicates heavily prioritize CI/CD infrastructure, we trace the exploit anatomy of CVE-2026-63077 and how attackers pivot from a build server into total enterprise compromise.+-----------------------------------------------------------------------------------+
| CVE-2026-63077 CI/CD ATTACK ARCHITECTURE |
|---|
Remote Unauthenticated Attacker JetBrains TeamCity Server Internal Build Agents & Cloud Repos
| (Java / Tomcat / Spring) (AWS, Azure, Git Repos)
| | |
| 1. Dispatches crafted HTTP request to exposed | |
| TeamCity web interface (TCP 8111 / 443): | |
| - Bypasses authentication filter | |
| - Triggers unauthenticated administrative endpoint | |
|------------------------------------------------------>| |
| | 2. Flaw triggers: |
| | - Bypasses Spring Security filter |
| | - Creates rogue Administrator user |
| | or executes arbitrary build step! |
| | |
| 3. Authenticates as rogue Admin & deploys | |
| malicious build configuration: | |
| `ExecuteScript("powershell -enc
|------------------------------------------------------>| |
| | 4. Dispatches build tasks to connected |
| | enterprise build agents: |
| |------------------------------------------>|
| | |
| | 5. Steals stored CI/CD secrets: |
| | - AWS IAM keys & Service Principals |
| | - GitHub/GitLab deployment tokens |
| | - Code-signing private certificates |
| |<------------------------------------------|
| | |
| 6. Siphons source code repositories & deploys | |
| ransomware across all connected build clusters! | |
|<======================================================|===========================================>
1. The Vulnerability: Authentication Bypass in Request Handling
JetBrains TeamCity relies on a modular Java architecture built atop an embedded Apache Tomcat web server and Spring Framework components:
* CVE-2026-63077 stems from an authentication bypass vulnerability within the web application’s path-handling and authorization filters.
* An attacker submits specially crafted HTTP requests to internal administrative controllers or legacy servlet paths. Due to an inconsistency between how the front-end routing filter and the internal endpoint controller normalize URI paths, the request bypasses mandatory authentication checks.
* The attacker is able to trigger administrative actions—including generating new administrative user tokens, creating rogue user accounts, or invoking diagnostic execution endpoints—without possessing credentials or session cookies.
2. From Admin Access to Arbitrary Command Execution
In a CI/CD server, administrative privileges are synonymous with arbitrary code execution by design:
* Once administrative access is obtained via the bypass, the attacker creates a new project or modifies an existing build configuration.
* The attacker adds a malicious command-line build runner (such as a Bash script on Linux or PowerShell on Windows) containing their payload.
* The attacker triggers a build: the TeamCity server dispatches the task to all connected build agents, executing the payload across multiple internal workstations and virtual machines in parallel.
3. Supply Chain Blast Radius: The Keys to the Cloud
A compromised CI/CD server is uniquely devastating because of the secrets it stores:
* Cloud Infrastructure Credentials: TeamCity build parameters frequently store long-lived AWS Access Keys, Azure Service Principal secrets, and Google Cloud service account keys used to deploy code into production.
* Code-Signing Keys: Threat actors harvest private code-signing certificates to digitally sign their own malware binaries, allowing them to bypass operating system security warnings like Windows SmartScreen.
* Source Code Theft: Attackers clone proprietary codebases for double-extortion schemes, threatening to publicly leak intellectual property if ransom demands are not met.
Active Exploitation: Ransomware Operators in the Wild
Threat intelligence telemetry confirms that multiple financially motivated cyber extortion syndicates are actively leveraging CVE-2026-63077:
* Automated IPv4 Reconnaissance: Attackers deploy mass port scanners searching for TeamCity web interfaces on ports 8111, 8080, and 443.
* Rapid Weaponization: Ransomware groups exploit the vulnerability to gain an initial foothold, immediately dump credentials from memory, and push ransomware lockers to build agents and connected domain controllers within hours of access.
* CISA Federal Directive: CISA has urged all organizations operating on-premises TeamCity servers to verify their patch status immediately, mandating federal compliance deadlines to prevent wide-scale supply chain sabotage.
Defensive Hardening & Enterprise Remediation Blueprint
DevSecOps teams, infrastructure administrators, and enterprise security operations centers must execute immediate containment and patching protocols:
1. Upgrade TeamCity On-Premises Immediately (Primary Fix)
Deploy the official security updates released by JetBrains:
* Upgrade all TeamCity On-Premises servers to version 2026.07 or later.
* For organizations unable to perform an immediate full platform upgrade, install the official JetBrains security patch plugin corresponding to your installed release.
* Verify upgrade completion and ensure all connected build agents are updated.
2. Sever Public Internet Exposure (Zero-Trust Principle)
No CI/CD management server should ever be directly exposed to the public internet:
* Ensure your TeamCity web interface is accessible only via internal corporate networks, isolated management VLANs, or behind an authenticating enterprise VPN with Phishing-Resistant MFA.
* At your perimeter firewall, block all external access to TCP port 8111.
3. Immediate Threat Hunting & Indicators of Compromise (IoCs)
Perform a thorough forensic audit across your TeamCity server:
* Audit User Accounts: Check the TeamCity administration console for newly created or unauthorized administrator accounts:Administration > Users > Filter by Administrator role
* Review Server Audit Logs: Inspect teamcity-server.log and teamcity-activities.log for anomalous requests to administrative endpoints originating from external IP addresses.
* Inspect Build Configurations: Review recently created or modified build steps for unexpected PowerShell, Bash, or curl download commands:Administration > Projects > Audit Log
4. Mandatory Secret Rotation
If an unpatched TeamCity server was exposed to the internet, assume that all stored credentials have been compromised:
* Immediately rotate all AWS/Azure/GCP service account keys stored in TeamCity parameters.
* Revoke and reissue all GitHub, GitLab, and Bitbucket personal access tokens (PATs) and SSH deployment keys.
* Audit and re-evaluate code-signing certificate storage.
________________
For technical vulnerability breakdowns, software supply chain security research, and enterprise threat advisories, subscribe to Digital Spying.