CVE-2024-27198: JetBrains TeamCity authentication bypass allows admin actions

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable authentication bypass with CVSS 9.8, KEV listing, ransomware use and near-certain exploitation probability.

What it is

JetBrains TeamCity before 2023.11.4 contains an authentication bypass via an alternate path (CWE-288), letting an unauthenticated attacker reach functionality intended for administrators. Because TeamCity is a CI/CD server, compromise exposes build pipelines, credentials and deployment infrastructure.

Impact

An attacker can perform administrative actions without valid credentials, effectively taking full control of the TeamCity server and anything it builds or deploys.

Attack surface

Reachable over the network via HTTP with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or intranet-exposed TeamCity instance below 2023.11.4 is in scope.

Exploitation

Listed in CISA KEV since 2024-03-07 with known ransomware campaign use, and EPSS 30-day probability is 0.99938 (99.97th percentile). Press coverage referenced in the record describes mass exploitation and rogue account creation.

What to do

• Upgrade TeamCity to 2023.11.4 or later immediately; this is the only complete fix.
• If immediate upgrade is impossible, apply JetBrains' vendor-supplied mitigation or take the server offline, per CISA's required action.
• Restrict network access to the TeamCity web interface to trusted management networks or VPN rather than exposing it to the internet.
• Rotate credentials, tokens and secrets stored in or reachable from TeamCity, and audit for unauthorized admin accounts.
• Review build configurations and deployment pipelines for tampering introduced during the exposure window.

Detection

• Audit TeamCity logs for requests to unexpected or alternate paths that precede admin-level actions from unauthenticated sessions.
• Alert on creation of new administrator accounts or permission changes outside known change windows.
• Monitor for anomalous build, plugin or agent configuration changes and unexpected outbound connections from the TeamCity host.
• Hunt for known post-exploitation indicators such as rogue accounts and webshell or plugin drops on the server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.