Posted on

JetBrains TeamCity CVE-2026-63077 – Ransomware-Linked Exploitation Escalation

Threat Overview

CVE-2026-63077 is a critical unauthenticated remote-code-execution vulnerability in JetBrains TeamCity On-Premises. JetBrains patched it in July and confirmed active exploitation in August, so the vulnerability itself is not new. The September 24 intelligence change is that current CISA reporting now associates the vulnerability with known ransomware campaign use. The flaw is reachable over HTTP(S) through the TeamCity agent polling protocol and can execute operating-system commands with the privileges of the TeamCity server process.

References

Impacted Systems

JetBrains TeamCity On-Premises versions earlier than 2025.11.7 and 2026.1.3. A security patch plugin is available for TeamCity 2017.1 and later when upgrade is not immediately possible. TeamCity Cloud is not affected. Exposure requires HTTP(S) network reachability to the TeamCity server.

Why this matters

The new ransomware association raises the operational priority of any remaining unpatched TeamCity exposure. TeamCity often holds source code, build secrets, deployment credentials, and access to downstream environments, making it a high-impact initial-access target.

Exploitation Status

Active exploitation has been confirmed since August. The September 24 update is the ransomware-use escalation, not a newly disclosed vulnerability. JetBrains reports attempted and successful exploitation of unpatched servers. Patched servers can still show blocked exploit artifacts such as unauthorized agents named scan-<random digits> with ForbiddenClassException entries.

What this hunt looks for

Unauthorized TeamCity agents, scan-<digits> names, XStream ForbiddenClassException or ConversionException activity, TeamCity Java processes spawning shells, new scripts or JSP files, service persistence, credential-access tooling, and new outbound destinations.

Required logs

TeamCity application logs forwarded to Syslog or another Sentinel table, Defender XDR DeviceProcessEvents, DeviceFileEvents and DeviceNetworkEvents when the host is onboarded, and Windows SecurityEvent where TeamCity runs on Windows.

First Pass – TeamCity Exploit Log Indicators

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("ForbiddenClassException","ConversionException","scan-")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Unauthorized scan- Agent Pattern

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage matches regex @"scan-[0-9]+"
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

TeamCity Java Spawning Shells

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("java","java.exe")
| where InitiatingProcessCommandLine has "TeamCity"
| where FileName in~ ("sh","bash","dash","cmd.exe","powershell.exe","pwsh.exe","python","python3","curl","wget")
| project Timestamp,DeviceName,AccountName,InitiatingProcessCommandLine,FileName,ProcessCommandLine,SHA256
| order by Timestamp desc

TeamCity-Created JSP and Script Files

DeviceFileEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("java","java.exe")
| where InitiatingProcessCommandLine has "TeamCity"
| where FileName endswith ".jsp" or FileName endswith ".war" or FileName endswith ".sh" or FileName endswith ".ps1" or FileName endswith ".bat"
| project Timestamp,DeviceName,ActionType,FileName,FolderPath,SHA256,InitiatingProcessCommandLine
| order by Timestamp desc

TeamCity Host Outbound Network Activity

DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("java","java.exe")
| where InitiatingProcessCommandLine has "TeamCity"
| project Timestamp,DeviceName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort
| order by Timestamp desc

New TeamCity Outbound Destinations

let Known=DeviceNetworkEvents
| where Timestamp between (ago(30d)..ago(7d))
| where InitiatingProcessFileName in~ ("java","java.exe")
| where InitiatingProcessCommandLine has "TeamCity"
| summarize by DeviceId,RemoteIP,RemoteUrl;
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ("java","java.exe")
| where InitiatingProcessCommandLine has "TeamCity"
| join kind=leftanti Known on DeviceId,RemoteIP,RemoteUrl
| project Timestamp,DeviceName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort
| order by Timestamp desc

Post-Exploitation Credential Tooling

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine has_any ("sekurlsa","lsass","comsvcs.dll","procdump","reg save hklm\\sam","ntdsutil","rclone","7z ","7za ")
| project Timestamp,DeviceName,AccountName,FileName,ProcessCommandLine,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc

Windows Service Persistence

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 7045
| project TimeGenerated,Computer,Account,Activity,EventData
| order by TimeGenerated desc

Detection Notes

A scan-<digits> agent plus ForbiddenClassException on a patched server can represent a blocked exploit attempt rather than compromise. Application logs should be correlated with child processes, file creation, and network activity. The TeamCity string in Defender process command lines depends on deployment details and may need local adjustment.

Leave a comment