Article
KEV and ransomware: which entries are flagged
361 of 1739 CISA KEV entries (20.8 percent) are flagged as used in ransomware campaigns. Mail and file transfer servers lead at 38.7 percent…
Read more
Exploited vulnerability
TeamCity authentication bypass (CVE-2024-27198)
CVE-2024-27198
CVE-2024-27198 is a flaw in JetBrains TeamCity On-Premises, a tool software teams use to build and ship code.
- On CISA KEV
- CVE ID
- CVE-2024-27198
- CISA KEV
- Listed
- Affected product
- TeamCity On-Premises
- Exploited
- Yes
- Published
- March 2024
In short
CVE-2024-27198 is a flaw in JetBrains TeamCity On-Premises, a tool software teams use to build and ship code. An outsider with no login can skip the login checks and take admin control of the server. CISA lists it as a known exploited vulnerability, and the vendor fixed it in version 2023.11.4.
- CVECVE-2024-27198
- ProductJetBrains TeamCity On-Premises
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedUpdate to the fixed version · Follow the KEV required action
What it allows
Per the vendor, an unauthenticated attacker who can reach the TeamCity server over HTTP or HTTPS can get around the authentication checks and gain administrative control of that server. NVD describes it as an authentication bypass that allows admin actions, and scores it 9.8 (critical) with network access, low complexity, no privileges and no user interaction needed. A build server often holds code and the keys used to publish software, so admin control is a serious foothold.
Who is affected
All TeamCity On-Premises versions through 2023.11.3 are affected. The fix is in version 2023.11.4. The vendor says its cloud service was already patched and was verified as not attacked.
The flaw was found in February 2024 and reported to the vendor through coordinated disclosure. The vendor announced it on 5 March 2024 together with a second flaw, CVE-2024-27199, and NVD published the entry on 4 March 2024.
CISA added CVE-2024-27198 to its Known Exploited Vulnerabilities (KEV) catalog on 7 March 2024, with a federal due date of 28 March 2024. The catalog names the entry "JetBrains TeamCity Authentication Bypass Vulnerability". It does not name a group, and we found no CISA or FBI advisory that names this CVE, so no group is linked here.
What to do
-
Update to the fixed version
Upgrade TeamCity On-Premises to 2023.11.4 or later. The vendor says you can download it or use the automatic update option inside TeamCity.
-
Use the patch plugin if you cannot upgrade
The vendor released security patch plugins for servers that cannot move to 2023.11.4: security_patch_2024_02.zip for TeamCity 2018.2 and newer, and security_patch_2024_02_pre2018_2.zip for 2018.1 and older. The vendor says the plugin only patches these flaws, so plan the full upgrade as well.
-
Follow the KEV required action
CISA's entry says to apply mitigations per vendor instructions, or stop using the product if no mitigation is available.
-
Limit who can reach the server
The flaw needs HTTP or HTTPS access to the server. Keep build servers off the open internet where you can, and put them behind a VPN or allow list.
-
Check for signs of misuse
If an unpatched server was reachable, review it for unexpected admin accounts or access tokens, and rotate any secrets stored in it. This is general practice, not a step from the vendor notice. The vendor notice lists no indicators of compromise.
Questions
What is CVE-2024-27198?
It is an authentication bypass in JetBrains TeamCity On-Premises. Per the vendor, an unauthenticated attacker who can reach the server over HTTP or HTTPS can skip the login checks and gain administrative control. It is rated critical, 9.8.
Which TeamCity versions are affected and what is the fix?
All TeamCity On-Premises versions through 2023.11.3 are affected. The fix is version 2023.11.4. The vendor also released a security patch plugin for servers that cannot upgrade yet.
Is CVE-2024-27198 exploited?
CISA added it to the Known Exploited Vulnerabilities catalog on 7 March 2024. The catalog does not name a group.
Is TeamCity Cloud affected?
The vendor says TeamCity Cloud servers were already patched and it verified they were not attacked. The risk is for On-Premises servers on 2023.11.3 or older.
Why does a TeamCity breach matter?
A build server often holds code and the keys used to publish software, so admin control is a serious foothold. Keep build servers off the open internet where you can.
Was a second flaw fixed at the same time?
Yes. The vendor announced CVE-2024-27199 together with this one, and version 2023.11.4 fixes both.
In our research
- KEV and ransomware: which entries are flagged October 2026
- KEV additions 2024 to 2026 by product type October 2026
Sources
- Additional Critical Security Issues Affecting TeamCity On-Premises (CVE-2024-27198 and CVE-2024-27199) JetBrains (vendor advisory)
- CVE-2024-27198 record NIST National Vulnerability Database
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.