ClosedCriticalPatched

JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited

JetBrains TeamCity

JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. Added to the CISA KEV catalog on 2024-03-07. CISA lists known use in ransomware campaigns.

Why this severity: CVSS 9.8 (v3.1, CNA), actively exploited (CISA KEV); known ransomware use

Started: Mar 4, 2024
Closed: Mar 7, 2024
CVEs: CVE-2024-27198 CVE-2024-27199

Updated Mar 7, 2024

Affected

TeamCity On-Premises before 2023.11.4 (JetBrains)

Fixed in

2023.11.4 (JetBrains)

Timeline4

Mar 7, 2024
CISA added CVE-2024-27198 to the KEV catalog (federal deadline 2024-03-28)
Source
Mar 4, 2024
CVE-2024-27198 published
Source
Mar 4, 2024
CVE-2024-27199 published
Source
Mar 4, 2024
JetBrains releases TeamCity 2023.11.4; Rapid7 publishes details of both auth bypasses
Source

Advisories5

News & write-ups1

CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity multiple authentication bypass vulnerabilitiesRapid7 · Mar 4, 2024 · Write-up

Notes & caveats

Derived from the CISA KEV JSON feed (catalogVersion 2026.10.21); CVSS from the CVE record (cveawg.mitre.org). startedAt is the CVE publication date when it fell in 2024 before the KEV listing, else the KEV dateAdded; exploitation may have begun earlier. closedAt is the KEV listing date (a fix or mitigation was available then unless noted).

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified