---
title: "TeamCity CVE-2024-27198: Auth Bypass Used by Ransomware"
url: https://erroneo.us/security/briefs/teamcity-cve-2024-27198-auth-bypass/
description: "Unauthenticated admin takeover of TeamCity On-Premises before 2023.11.4, mass-exploited in March 2024 with ransomware. Upgrade to a current release and hunt."
type: security-brief
section: "Security Digest"
date_published: 2024-03-04
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-27198"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# TeamCity CVE-2024-27198: Auth Bypass Used by Ransomware

**Verdict: Check exposure.** Any TeamCity server that was internet-reachable and below 2023.11.4 in March 2024 may have been taken over; upgrade to a current release (which also fixes 2026's CVE-2026-63077) and audit for rogue admins and plugins.

- **Who must act:** Owners of self-hosted TeamCity servers that ran 2023.11.3 or older without the security patch plugin at any point after March 4, 2024, especially internet-facing ones.
- **Who can relax:** TeamCity Cloud customers, whom JetBrains patched and says were not attacked, and on-prem servers that were patched promptly and are now on a current release.
- **Affected:** TeamCity On-Premises, all versions through 2023.11.3
- **Fixed:** TeamCity 2023.11.4; Security patch plugin for TeamCity 2018.2 and newer, and a separate one for 2018.1 and older; Current releases (2025.11.7 or 2026.1.3 and later also fix CVE-2026-63077)
- **CVEs:** CVE-2024-27198
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the TeamCity version on every self-hosted server (shown in the web UI footer and under Administration).
2. Upgrade to a current TeamCity release; 2023.11.4 fixes this bug, but 2025.11.7 or 2026.1.3 and later are needed for 2026's CVE-2026-63077.
3. Keep the TeamCity web UI off the internet or behind a VPN or SSO proxy.
4. Audit administrator accounts, access tokens and installed plugins, and remove anything you cannot explain.
5. If compromise is likely, rebuild the server and agents and rotate every secret TeamCity holds (VCS tokens, cloud keys, signing keys, deployment credentials).

### How to check if you are affected

- Search teamcity-javaLogging-*.log for request URIs matching the regex ;\S*\.jsp\?\S*jsp= (Rapid7's indicator).
- Search teamcity-activities.log and teamcity-server.log for user_create, plugin_uploaded, plugin_disable, plugin_deleted and delete_token_for_user events you cannot explain.
- Check config/disabled-plugins.xml and the plugins directories for plugins nobody installed.
- Look for the TeamCity java process spawning cmd.exe, PowerShell, certutil or msiexec, a new local 'Default$' admin account, or files renamed to .lsoc (Jasmin ransomware).

## What happened

On March 4, 2024, JetBrains [disclosed](https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/) two flaws in TeamCity On-Premises, its self-hosted CI/CD server, fixed in 2023.11.4. CVE-2024-27198 is an authentication bypass through an alternate path (CWE-288, CVSS 3.1 9.8). It lets an unauthenticated attacker with HTTP(S) access gain administrative control of the server. A companion path traversal, CVE-2024-27199, is less severe.

[Rapid7](https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/) found both bugs and reported them in February. The flaw sits in how TeamCity handles a `jsp` query parameter on requests that end in a 404. A request such as `/hax?jsp=/app/rest/users;.jsp` reaches the REST API without logging in. One POST creates a new administrator; another mints an access token. Rapid7 published full details the same day, after JetBrains released the fix without the coordinated advisory Rapid7 expected.

Exploitation followed within days. CISA added CVE-2024-27198 to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27198) on March 7 and marks it as used in ransomware campaigns. [SecurityWeek](https://www.securityweek.com/recent-teamcity-vulnerability-exploited-in-ransomware-attacks/) reported LeakIX seeing rogue user creation on 1,400 instances, and GuidePoint suggesting the BianLian group may have used the bug for initial access. [Trend Micro](https://www.trendmicro.com/en_us/research/24/c/teamcity-vulnerability-exploits-lead-to-jasmin-ransomware.html) documented attacks dropping Jasmin ransomware, the XMRig miner, Cobalt Strike and the SparkRAT backdoor.

## Who is affected

Every TeamCity On-Premises version through 2023.11.3 is affected. The fix is 2023.11.4. JetBrains also shipped a security patch plugin for servers that could not upgrade, in one build for 2018.2 and newer and another for 2018.1 and older. TeamCity Cloud was patched by JetBrains, which says it saw no attacks there.

A server still on 2023.11.3 or older today has a second problem. CVE-2026-63077, an unauthenticated RCE that CISA added to KEV in 2026 and that has its own brief here, affects every TeamCity release before 2025.11.7 and 2026.1.3.

## Do you really need to act?

If your server was upgraded or plugin-patched in early March 2024, this bug is history. The risk is servers that were internet-facing and unpatched for even a few days after March 4, 2024. Exploitation was automated and large-scale, so presume such a server was touched. A CI server is a high-value target. It holds source code, VCS and cloud credentials, and signing keys, and it can push code to production, so a takeover can become a supply-chain incident.

## What to do now

1. Check the version on every self-hosted server. It appears in the web UI footer and under Administration.
2. Upgrade to a current release. 2023.11.4 closes this bug, but 2025.11.7, 2026.1.3 or later is needed for CVE-2026-63077.
3. Keep the TeamCity UI off the internet, or put it behind a VPN or SSO proxy.
4. Audit administrators, access tokens and plugins, and remove anything unexplained.
5. If compromise is likely, rebuild the server and agents and rotate every secret TeamCity stores.

## How to tell if you were hit

Rapid7's guidance targets the logs directory (`/opt/TeamCity/logs/` or `C:\TeamCity\logs\`). Run `grep -E ';\S*\.jsp\?\S*jsp=' teamcity-javaLogging-*.log` to find exploit-shaped URIs. Search `teamcity-activities.log` and `teamcity-server.log` for `user_create`, `plugin_uploaded`, `plugin_deleted` and `delete_token_for_user` events nobody can explain. Rapid7 notes that disabling a plugin leaves a permanent entry in `config/disabled-plugins.xml`, so check it for leftovers, and review the Audit page for new admins. On the host, Trend Micro saw TeamCity's `java.exe` spawning `cmd.exe`, `certutil` and PowerShell, a new local account named `Default$`, and files renamed with a `.lsoc` extension. Logs may have rotated away since 2024, so if a vulnerable server was exposed and you cannot prove otherwise, rebuild it.

## Timeline

- Feb 20, 2024 — Rapid7 sends its technical analysis to JetBrains, which reproduces the bugs the same day.
- Mar 4, 2024 — TeamCity 2023.11.4 is out (late Mar 3 in some time zones) with the patch plugin; JetBrains and Rapid7 publish details.
- Mar 7, 2024 — CISA adds CVE-2024-27198 to KEV (due March 28, 2024).
- Mar 19, 2024 — Trend Micro reports Jasmin ransomware, miners and backdoors deployed through the bug.

## Sources

1. [JetBrains — Additional critical security issues affecting TeamCity On-Premises (CVE-2024-27198 and CVE-2024-27199): update to 2023.11.4 now](https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/)
2. [CVE record — CVE-2024-27198](https://www.cve.org/CVERecord?id=CVE-2024-27198)
3. [NVD — CVE-2024-27198](https://nvd.nist.gov/vuln/detail/CVE-2024-27198)
4. [CISA — Known Exploited Vulnerabilities: CVE-2024-27198](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27198)
5. [Rapid7 — CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity multiple authentication bypass vulnerabilities](https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/)
6. [Trend Micro — TeamCity vulnerability exploits lead to Jasmin ransomware](https://www.trendmicro.com/en_us/research/24/c/teamcity-vulnerability-exploits-lead-to-jasmin-ransomware.html)
7. [SecurityWeek — Recent TeamCity vulnerability exploited in ransomware attacks](https://www.securityweek.com/recent-teamcity-vulnerability-exploited-in-ransomware-attacks/)

---
Source page: https://erroneo.us/security/briefs/teamcity-cve-2024-27198-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt