{"id":"CVE-2024-27198","kind":"vulnerability","aliases":["CVE-2024-27198"],"related":[],"title":"In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible","description":"JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"JetBrains TeamCity, a CI/build server, has an authentication bypass that lets an unauthenticated attacker perform administrative actions. CISA reports it is being exploited in the wild, including in ransomware campaigns.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-03-07T00:00:00+00:00","products":[{"name":"jetbrains teamcity","fixed":["2023.11.4"],"affected":"< 2023.11.4","ecosystem":"vendor"},{"name":"JetBrains TeamCity","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ci-cd","exploited","jetbrains","ransomware","runtime","self-hosted","teamcity"],"not_affected_if":["managed-hosting","unknown"],"how_to_check":null,"fix":"Apply the mitigation or upgrade per JetBrains vendor instructions; the sources do not name the fixed version.\nIf no mitigation is available, discontinue use of the product as CISA requires.","status":"open","published_at":"2024-03-04T18:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:00:56+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:00:56Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation or upgrade per JetBrains vendor instructions; the sources do not name the fixed version.\nIf no mitigation is available, discontinue use of the product as CISA requires.","reach":"internet","impact":"high","summary":"JetBrains TeamCity, a CI/build server, has an authentication bypass that lets an unauthenticated attacker perform administrative actions. CISA reports it is being exploited in the wild, including in ransomware campaigns.","category":"runtime","who_cares":["teamcity","jetbrains","self-hosted","ci-cd"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker gains admin control of the build server and its secrets.","analyst_note":"Find the affected and fixed TeamCity versions and the vendor mitigation steps at the JetBrains security advisory for CVE-2024-27198, and the check for exposure (e.g. the server's version or the presence of a vulnerable endpoint).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000488,"input_tokens":2809,"output_tokens":415,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':16A,19A '-27198':17A,20A '2023.11.4':5A 'action':12A,52B,80C,83C 'admin':11A,79C 'administr':51B 'allow':8A,74C 'appli':84C 'attack':49B,76C 'authent':6A,43B,70C 'bypass':7A,44B,71C 'campaign':65B 'cd':27B 'ci':26B 'ci-cd':25B 'ci/build':39B 'cisa':53B,81C 'contain':68C 'cve':15A,18A 'discontinu':90C 'exploit':28B,58B 'host':34B 'includ':62B 'instruct':88C 'jetbrain':2A,29B,36B,66C 'jetbrains':21A,23A 'let':46B 'mitig':85C,96C 'per':86C 'perform':10A,50B,78C 'possibl':14A 'product':94C 'ransomwar':30B,64B 'report':54B 'requir':82C 'runtim':31B 'self':33B 'self-host':32B 'server':40B 'teamciti':3A,35B,37B,67C 'teamcity':22A,24A 'unauthent':48B 'unavail':98C 'use':91C 'vendor':87C 'vulner':72C 'wild':61B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-03-04T18:15:09+00:00","kev":{"dateAdded":"2024-03-07","dueDate":"2024-03-28","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-27198","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27198","severity":null,"published_at":"2024-03-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-27198","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27198","severity":null,"published_at":"2024-03-04T18:15:09+00:00","modified_at":"2026-06-17T07:19:24+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}