{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:53:33.742Z",
  "tag": {
    "id": "teamcity",
    "label": "TeamCity",
    "isStack": false,
    "url": "https://pwn.watch/t/teamcity",
    "feed": "https://pwn.watch/t/teamcity/feed.xml"
  },
  "counts": {
    "incidents": 3,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 3
  },
  "incidents": [
    {
      "slug": "jetbrains-teamcity-cve-2026-63077",
      "title": "JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability",
      "url": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077",
      "json": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "JetBrains TeamCity",
      "tags": [
        "devtools",
        "jetbrains",
        "teamcity",
        "ransomware",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-63077"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-05",
      "closedAt": "2026-08-05",
      "updatedAt": "2026-08-05",
      "summary": "JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. Added to CISA KEV on 2026-08-05.",
      "xPost": null
    },
    {
      "slug": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "title": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "json": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "JetBrains TeamCity",
      "tags": [
        "devtools",
        "java",
        "jetbrains",
        "teamcity",
        "auth-bypass",
        "ci-cd",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-27198",
        "CVE-2024-27199"
      ],
      "affectedVersions": [
        "TeamCity On-Premises before 2023.11.4 (JetBrains)"
      ],
      "fixedVersions": [
        "2023.11.4 (JetBrains)"
      ],
      "startedAt": "2024-03-04",
      "closedAt": "2024-03-07",
      "updatedAt": "2024-03-07",
      "summary": "JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. Added to the CISA KEV catalog on 2024-03-07. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "title": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "json": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "JetBrains TeamCity On-Premises",
      "tags": [
        "devtools",
        "jetbrains",
        "teamcity",
        "ci-cd",
        "auth-bypass",
        "rce",
        "north-korea",
        "apt29",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-42793"
      ],
      "affectedVersions": [
        "Before 2023.05.4 (NVD)"
      ],
      "fixedVersions": [
        "2023.05.4"
      ],
      "startedAt": "2023-09-18",
      "closedAt": "2023-12-13",
      "updatedAt": "2023-12-13",
      "summary": "An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "jetbrains-teamcity-cve-2026-63077",
      "incidentTitle": "JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-05",
      "title": "CISA added CVE-2026-63077 to the KEV catalog (due 2026-08-08).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-07",
      "title": "CISA added CVE-2024-27198 to the KEV catalog (federal deadline 2024-03-28)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-04",
      "title": "CVE-2024-27198 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27198",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-04",
      "title": "CVE-2024-27199 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27199",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-04",
      "title": "JetBrains releases TeamCity 2023.11.4; Rapid7 publishes details of both auth bypasses",
      "body": null,
      "sourceUrl": "https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-12-13",
      "title": "CISA, FBI, NSA and partners: Russia's SVR exploiting TeamCity at scale (AA23-347A)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-18",
      "title": "Microsoft: North Korean actors Diamond Sleet and Onyx Sleet are exploiting it",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-04",
      "title": "CISA adds CVE-2023-42793 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-18",
      "title": "JetBrains releases TeamCity 2023.05.4 and a security patch plugin",
      "body": null,
      "sourceUrl": "https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    }
  ]
}