pwn.watch: TeamCity incident updates

[high] JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Wed, 05 Aug 2026 00:00:00 GMT

JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. Added to CISA KEV on 2026-08-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-05: CISA added CVE-2026-63077 to the KEV catalog (due 2026-08-08).

CVEs: CVE-2026-63077

[critical] JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited

Thu, 07 Mar 2024 00:00:00 GMT

JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. Added to the CISA KEV catalog on 2024-03-07. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: 2023.11.4 (JetBrains)

Latest updates:

2024-03-07: CISA added CVE-2024-27198 to the KEV catalog (federal deadline 2024-03-28) (source)
2024-03-04: CVE-2024-27198 published (source)
2024-03-04: CVE-2024-27199 published (source)

CVEs: CVE-2024-27198, CVE-2024-27199

[critical] TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)

Wed, 13 Dec 2023 00:00:00 GMT

An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.

Status: closed · Patch: patched · Fixed in: 2023.05.4

Latest updates:

2023-12-13: CISA, FBI, NSA and partners: Russia's SVR exploiting TeamCity at scale (AA23-347A) (source)
2023-10-18: Microsoft: North Korean actors Diamond Sleet and Onyx Sleet are exploiting it (source)
2023-10-04: CISA adds CVE-2023-42793 to the KEV catalog

CVEs: CVE-2023-42793