CVE-2023-42793: JetBrains TeamCity authentication bypass to RCE, exploited by ransomware and APTs
The short version: JetBrains TeamCity — a widely used CI/CD server — has an authentication bypass leading to remote code execution (CVE-2023-42793). An unauthenticated attacker runs code on the build server, and this one was seized on fast: it's in CISA's KEV catalog, tied to known ransomware use, and was leveraged in nation-state campaigns. If you run an affected version, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — unauthenticated RCE, ransomware + nation-state use |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.98% · 99th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2023-10-25 |
| Known exploited? | Yes — known ransomware use; also leveraged in nation-state campaigns |
| Vulnerability type | CWE-288 / CWE-306 authentication bypass → remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | JetBrains TeamCity before 2023.05.4 |
| Fixed in | 2023.05.4 |
What you need to know
TeamCity fails to enforce authentication on a critical function, so an unauthenticated attacker can bypass the login entirely and reach remote code execution on the server. There's no chain to build — a reachable, affected TeamCity is enough.
Why it was seized on so quickly:
- CI/CD servers are crown jewels. TeamCity holds source code, build secrets, signing keys, and deploy credentials, so owning it can compromise everything it builds and ships — a textbook supply-chain foothold.
- It's pre-authentication and trivially reachable. Build servers are frequently exposed for developer and pipeline access.
- It was operationalized fast. CISA lists it in KEV with a known-ransomware flag, and it featured in nation-state activity — the theoretical became operational within weeks of disclosure.
How serious we see it
Moderate — the 9.8 holds up.
Unauthenticated, network-reachable code execution on a high-value CI/CD server, KEV-listed with known ransomware and nation-state use and near-certain EPSS, is top-of-queue. The bounded, reassuring part is that it's narrow and fixable — specific versions, a published fix, quick to confirm. The catch is that this bug was weaponized quickly, so being patched and being clean are separate questions.
Recommendations
Straight from JetBrains' guidance and CISA:
- Patch now. Upgrade TeamCity to 2023.05.4 or later.
- Assume compromise if you were exposed — hunt. Follow JetBrains' post-mortem guidance to check for indicators, new admin users, and rogue tokens.
- If compromised, respond fully. Rotate build secrets, signing keys, and deploy credentials, and investigate downstream pipelines for tampering.
- Harden exposure. Keep the TeamCity server off the open internet where you can; restrict access to trusted networks.
- Confirm your exposure first. Verify whether you run an affected TeamCity version.
How BreachRisk sees it
BreachRisk discovers internet-facing TeamCity servers from little more than your domain, fingerprints the version, and flags exposure tied to this KEV-listed, actively exploited CVE — surfaced at the top of your results because it's in KEV and tied to ransomware. We detect and flag the exposed, affected version so a high-value build server is mapped before an attacker gets there.
That outside-in, continuous view is the whole point for CI/CD infrastructure: when a build-server RCE breaks, the exposed appliance is already on your radar, so you go straight to patch-and-verify.