CVE-2026-63077 ransomware use is now listed as known by CISA, materially raising the incident-response context around an already exploited JetBrains TeamCity vulnerability. The September 23 change does not represent a new vulnerability or the first evidence of exploitation. JetBrains had already warned that CVE-2026-63077 was being actively exploited. The new development is that CISA changed the vulnerability’s ransomware-campaign-use field from Unknown to Known.
Current answer: TeamCity On-Premises administrators should verify that their servers are on a fixed release or protected by JetBrains’s CVE-specific security patch, and environments that were exposed before remediation should review historical logs and unauthorized-agent evidence. CISA’s ransomware designation increases the consequence of historical exposure but does not prove that any specific TeamCity server was compromised or encrypted.
What changed for CVE-2026-63077 ransomware use?
CISA’s September 23 Known Exploited Vulnerabilities catalog update changed the knownRansomwareCampaignUse field for CVE-2026-63077 from Unknown to Known. The vulnerability had already been listed in KEV since August 5, and CISA’s original remediation deadline remained August 8.
This distinction matters because the underlying technical state did not suddenly change on September 23. CVE-2026-63077 was already a critical unauthenticated remote-code-execution vulnerability with confirmed exploitation and available fixes. What changed was CISA’s assessment of how the vulnerability is being used in real campaigns.
Was CVE-2026-63077 already being exploited?
Yes. JetBrains had already reported receiving evidence of active and attempted exploitation before CISA changed the ransomware field. Administrators should therefore treat September 23 as a risk-context escalation rather than the beginning of exploitation.
The vulnerability affects the TeamCity agent polling protocol and can allow unauthenticated remote code execution against vulnerable TeamCity On-Premises servers.
Does CISA identify the ransomware group?
No. The reviewed CISA KEV update marks ransomware campaign use as known but does not name the ransomware family, affiliate or operator. TPS therefore does not attribute the activity to a specific group.
The CISA field also does not mean every successful CVE-2026-63077 intrusion resulted in ransomware deployment. It establishes that the vulnerability is known to have been used in ransomware campaigns.
Which TeamCity versions fix CVE-2026-63077?
JetBrains says TeamCity On-Premises customers should upgrade to 2025.11.7 or 2026.1.3. Administrators should confirm their exact installed version rather than relying only on when the server was deployed or last maintained.
For organizations that cannot immediately upgrade, JetBrains provides a security patch plugin for supported TeamCity releases beginning with TeamCity 2017.1. The plugin addresses CVE-2026-63077 specifically and should not be treated as a replacement for broader product maintenance.
Does TeamCity Cloud require action?
JetBrains says TeamCity Cloud customers do not need to take action for CVE-2026-63077. The remediation and investigation guidance in this article is primarily relevant to TeamCity On-Premises environments.
What should administrators check if the server was exposed?
JetBrains has published several pieces of evidence administrators can use when reviewing possible exploitation. One is a ConversionException in TeamCity logs. JetBrains says this can be associated with attempted or successful exploitation and should be investigated rather than treated as proof of compromise by itself.
On protected servers, a ForbiddenClassException can indicate that a malicious deserialization attempt reached the server but was blocked by the protection in place.
What do unauthorized scan agents mean?
JetBrains has also documented unauthorized build-agent entries whose names begin with scan-. These can appear during CVE-2026-63077 exploitation attempts.
The presence of a suspicious agent should be correlated with logs and other server evidence. JetBrains cautions that an agent’s displayed creation time is not necessarily the exact time an attack occurred, so administrators should avoid reconstructing an incident timeline from that field alone.
Why does ransomware use raise the consequence?
A TeamCity server can occupy a sensitive position in the software delivery process. Successful exploitation may expose TeamCity configuration, stored credentials, build-system data and server state. Depending on the environment and attacker access, compromise can also create risk for build artifacts and downstream CI/CD workflows.
CISA’s ransomware classification does not prove those downstream consequences occurred in every incident, but it increases the reason to investigate previously exposed servers rather than treating installation of the current patch as the end of the response.
TeamCity Cloud customers do not need CVE-2026-63077 remediation action according to JetBrains. On-premises servers should continue through the exposure check.
Confirm the server is on TeamCity 2025.11.7, 2026.1.3 or another vendor-supported state explicitly protected by the CVE-specific security patch.
Apply the JetBrains-provided fix and restrict unnecessary external reachability until the affected server is protected.
Check TeamCity logs for relevant ConversionException or ForbiddenClassException events and review unauthorized agents such as scan-prefixed entries in context.
If evidence suggests successful code execution, unauthorized access or follow-on activity, preserve relevant records and move the system into the organization’s established incident-response process.
Does patching prove the server was never compromised?
No. Patching closes the known vulnerability for the protected state, but it does not retrospectively determine whether exploitation occurred while the server was vulnerable. Previously reachable systems should be assessed using the historical evidence available to the organization.
Likewise, a blocked exploit indicator on a protected server should not automatically be described as a successful compromise. The investigation should distinguish attempted exploitation, blocked exploitation and evidence of successful post-exploitation activity.
What remains unknown?
CISA’s current KEV update does not identify a ransomware family or operator, the number of affected organizations, victim geography, the proportion of TeamCity exploitation that progressed to ransomware, or the exact ransomware deployment chain.
Those unknowns limit attribution but do not change the immediate remediation answer for vulnerable TeamCity On-Premises servers.
What would materially change this article?
A named ransomware family or operator, confirmed victim disclosures, additional CISA context, new JetBrains indicators, revised fixed-version guidance or new incident-response findings would materially change the current answer and should update this same canonical URL.
Verification note
TPS reviewed the direct CISA KEV repository change that moved CVE-2026-63077 ransomware campaign use from Unknown to Known and reconciled that state with JetBrains’s current exploitation, remediation and investigation guidance. The ransomware classification is confirmed; actor identity, campaign scale and compromise of any specific environment remain unresolved.
Bottom line: CISA’s ransomware designation materially raises the consequence of CVE-2026-63077 exposure, but it does not change the fundamental administrator workflow. Verify the TeamCity On-Premises version or security patch, reduce exposure where necessary, and investigate credible historical indicators if the server was reachable before protection was applied.