The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that ransomware groups are actively exploiting CVE-2026-63077, a critical authentication bypass vulnerability affecting JetBrains TeamCity On-Premises. TeamCity is a build management and continuous integration/continuous delivery (CI/CD) server. The flaw, tracked as CVE-2026-63077, can allow unauthenticated attackers with HTTP(S) access to execute arbitrary operating system commands with the privileges of the TeamCity server process. JetBrains patched the flaw on July 25, 2026, in TeamCity versions 2025.11.7 and 2026.1.3, while CISA added it to its Known Exploited Vulnerabilities (KEV) Catalog on August 5, 2026, and later flagged it as being used in ransomware attacks. Successful exploitation could expose sensitive TeamCity data, configurations, and stored credentials, as well as modify server states, and compromise build artifacts and downstream CI/CD pipelines. Shadowserver is currently tracking over 160 Internet-exposed TeamCity servers that remain vulnerable, down from roughly 700 immediately after disclosure. This vulnerability is the fourth TeamCity vulnerability since October 2023 that CISA has linked to both active exploitation and ransomware activity, underscoring the continued targeting of exposed CI/CD infrastructure by cybercriminal and state-sponsored threat actors. CTIX analysts urge any affected organizations to ensure that they are running patched infrastructure to prevent exploitation.