<![CDATA[🔴 Critical: CISA: Ransomware gangs now exploiting critical TeamCity flaw]]>

<![CDATA[🔴 Critical: CISA: Ransomware gangs now exploiting critical TeamCity flaw]]>CISA has issued a warning that ransomware operators are now exploiting a critical JetBrains TeamCity vulnerability, adding it to the agency's list of flaws known to be actively abused in attacks. The flaw was originally patched back in July, but threat actors have since adopted it as an entry point for ransomware deployments, prompting federal agencies to treat it as an urgent patching priority.

The vulnerability affects on-premises TeamCity servers, which are widely used for continuous integration and build management. Because these systems often hold sensitive credentials and have broad access to internal development pipelines, a compromised server can give attackers a foothold deep inside an organization's infrastructure. CISA's guidance directs federal agencies to apply the available fixes or take mitigating steps as soon as possible.

Key points for defenders:

The vulnerability is actively exploited by ransomware gangs, not just theoretical.
A patch has been available since July; unpatched internet-facing servers remain at risk.
On-premises TeamCity instances are the primary concern.
Federal agencies are required to remediate under CISA's binding directives.

Administrators running self-hosted TeamCity should verify their version against JetBrains' July security release, apply the update immediately if they haven't already, and review logs for signs of unauthorized access. Rotating any credentials or tokens stored on the server is also worth considering if compromise is suspected.

Source: BleepingComputer

Has your organization already patched its TeamCity servers, or are you still working through the remediation?

]]>https://xploitlk.com/topic/449/critical-cisa-ransomware-gangs-now-exploiting-critical-teamcity-flawRSS for NodeTue, 27 Oct 2026 11:01:03 GMTThu, 24 Sep 2026 12:30:21 GMT60