CISA: Ransomware gangs now exploiting critical TeamCity flaw
AI summary · glm-5.3Summaries by Vani AI
Ransomware gangs are exploiting a critical JetBrains TeamCity flaw (CVE-2026-63077) and are being used in ransomware attacks.
Ransomware gangs are now exploiting a critical JetBrains TeamCity flaw (CVE-2026-63077), which allows unauthenticated attackers to execute arbitrary operating system commands and potentially expose sensitive data.
Key facts
- Ransomware gangs are exploiting a critical JetBrains TeamCity vulnerability (CVE-2026-63077).
- The flaw allows unauthenticated attackers to execute arbitrary OS commands via HTTP(S) and TeamCity agent polling.
- CISA has added the vulnerability to its actively exploited list and ordered federal agencies to secure networks within three days.
- The vulnerability has been abused by ransomware gangs and is tracked by Shadowserver at over 160 unpatched servers.
- CVEs
- CVE-2026-63077
- ATT&CK
- T1565 ReconnaissanceT1100 Collect Initial InformationT1486 Data Encrypted for ImpactT1078 Collect DataT1190 Exploit Public-Facing Application
- Products
- TeamCity
- Threat actors
- APT29
- Malware
- ransomware gangs
- Victims
- U.S. federal agencies
- Countries
- U.S.
- AI models
- JetBrains TeamCity
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-63077 | Unauthenticated Deserialization RCE in JetBrains TeamCity On-Premises | 9.8 | 95% | KEVRansomwarePoC | KEV |
From the original article
2 min read at bleepingcomputer.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July.
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.