Vulnerability
Critical unauthenticated remote code execution flaw in JetBrains TeamCity, patched July 25, 2026, later exploited by ransomware groups per CISA.
CISA said Sept. 23 that ransomware crews are exploiting CVE-2026-63077, an unauthenticated 9.8 RCE in JetBrains TeamCity patched July 25. Any build server patched late has to be handled as breached, including the credentials and signing keys it held.
Reality
Sixteen new modules landed in the framework, ten of them exploits, and Rapid7 counts five of those against CISA's exploited list. The SonicWall entry runs September's zero-day chain from SSRF to root.
Reality
The September 3 note closed the investigation without adding a single affected user, but it put project source code and credentials in current Cadence storage inside a blast radius that had been limited to a 2024 backup.
Reality
CVE-2026-63077 was in CISA's KEV catalog on August 5. JetBrains dates the intrusion into its own Cadence environment from August 8 to August 24, and every secret that touched the service now needs rotating.
Reality
JetBrains says CVE-2026-63077 lets an unauthenticated attacker run arbitrary commands on a TeamCity server. The rotation list it handed Cadence users doubles as the recovery scope for anyone self-hosting.
Reality