CVE-2024-27198: JetBrains TeamCity authentication bypass, mass-exploited
The short version: JetBrains TeamCity On-Premises shipped with two flaws disclosed together — an authentication bypass (CVE-2024-27198) and a path traversal (CVE-2024-27199). The bypass lets an unauthenticated attacker reach administrative endpoints and create rogue admin accounts, which on a CI/CD server means control of your builds and secrets. Both were mass-exploited and both are in CISA's KEV catalog. If you run TeamCity below 2023.11.4, patch and then check for accounts you didn't create. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVE-2024-27198) |
| Companion flaw | CVE-2024-27199 — 7.3 High · AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (path traversal, limited admin actions) |
| EPSS | ~99.94% · 99.97th percentile (2026-07-17) for CVE-2024-27198 |
| In CISA KEV? | Yes — CVE-2024-27198 remediation was due 2024-03-28; CVE-2024-27199 due 2026-05-04 |
| Known exploited? | Yes — mass exploitation, rogue admin accounts created; associated with ransomware activity |
| Vulnerability type | CWE-288 authentication bypass → admin takeover; CWE-22 path traversal (companion) |
| Requires authenticated session? | No — pre-authentication |
| Affected | JetBrains TeamCity On-Premises before 2023.11.4 |
| Fixed in | 2023.11.4 (and later) |
What you need to know
TeamCity is a CI/CD build server — the machine that compiles your code, holds deployment credentials, and pushes artifacts. That makes it a high-value target: control the build server and you can reach source, secrets, and everything downstream of the pipeline.
CVE-2024-27198 is the serious one. It's an authentication bypass in the web component that lets an unauthenticated attacker reach endpoints that should require an admin session — including the ones that create users and generate access tokens. In the wild, attackers used it to stand up their own administrator accounts. CVE-2024-27199 is a path traversal that permits a narrower set of unauthenticated admin actions; BreachRisk fingerprints exposure to this pair.
- It's a build server. Admin control reaches your code, your pipeline, and the credentials it stores — not just one host.
- It's pre-authentication and internet-reachable. Many TeamCity consoles are exposed for remote developers; no credential or chain is needed.
- It was live at scale. Public exploitation followed disclosure quickly, so an unpatched, exposed instance may already have been touched.
How serious we see it
High — the 9.8 is not hyperbole here.
Unauthenticated administrative takeover of a CI/CD server, confirmed exploited in the wild, is top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects TeamCity On-Premises below 2023.11.4, the fix is published, and exposure is quick to determine. The catch is the usual one for a mass-exploited flaw — being patched and being clean are separate questions, so check for rogue accounts and tokens after you upgrade.
Recommendations
Straight from JetBrains' guidance and CISA:
- Patch now. Upgrade TeamCity On-Premises to 2023.11.4 or later. (TeamCity Cloud was addressed by JetBrains.)
- Hunt for abuse. Review administrator accounts, access tokens, and audit logs for entries you don't recognize — attackers created their own admin users.
- If you find evidence of compromise, respond. Rotate all credentials and tokens stored in or reachable from TeamCity, and review recent builds and deployments for tampering.
- Reduce exposure. Keep the TeamCity console off the open internet where you can; restrict it to trusted networks or a VPN.
- Confirm your exposure first. Verify whether you run an internet-facing TeamCity On-Premises server, and which version.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing TeamCity login panels, fingerprints the version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this pair — surfaced at the top of your results because it's in KEV and because a build server earns priority. We detect and flag the exposed, affected instance; we don't exploit it.
That outside-in, continuous view is the point: when a CI/CD flaw is being mass-exploited, the exposed server is already mapped, so you can go straight to patch-and-verify.