erroneo.us
Search all guides⌘K

Security Digest · Mar 4, 2024 · Vulnerability · CI/CD

TeamCity CVE-2024-27199: Path Traversal Joins KEV in 2026

TeamCity On-Premises through 2023.11.3 let unauthenticated users swap the HTTPS certificate. In KEV since April 2026 with ransomware use. Confirm upgrades.

Published By erroneo.us Security Desk · Updated 3 min read9 sources

Our verdict

Check exposure

Fixed since March 2024 alongside a critical sibling; confirm no TeamCity server is still on 2023.11.3 or older, move everything to a build that also fixes CVE-2026-63077, and hunt on servers that were exposed and unpatched in March 2024.

Who must act: Owners of self-hosted TeamCity servers still on 2023.11.3 or older, servers patched only with the 2024 plugin, and anyone whose server was internet-facing and unpatched in early March 2024.

Who can relax: TeamCity Cloud customers, and on-prem teams that upgraded in March 2024, are now on 2025.11.7, 2026.1.3 or later, and do not expose the server publicly.

Affected
TeamCity On-Premises, all versions through 2023.11.3
Fixed in
TeamCity 2023.11.4 (Mar 2024)
Security patch plugin for versions through 2023.11.3 (fixes CVE-2024-27198 and CVE-2024-27199 only)
Current releases; servers should now be on 2025.11.7, 2026.1.3 or later because of CVE-2026-63077
CVSS
7.3 (v3.1, CNA)
EPSS
100.0% (percentile 100.0)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Inventory every TeamCity On-Premises server and record its version from the web UI footer or GET /app/rest/server.
  2. Upgrade anything older than 2025.11.7 or 2026.1.3 to a current release; the 2024 patch plugin covers only the March 2024 bugs.
  3. Remove direct internet exposure: put TeamCity behind a VPN or an IP allowlist.
  4. Check that the HTTPS certificate and port the server uses are the ones you configured.
  5. If a server was exposed and unpatched in March 2024, hunt for CVE-2024-27198 activity too and rotate every secret it stores.

How to check if you are affected or compromised

  • Search reverse-proxy logs for paths containing /res/../, /update/../ or /.well-known/acme-challenge/../, including URL-encoded dots.
  • Look for requests to /app/https/settings/uploadCertificate, setPort or removeCertificate that your admins did not make.
  • Compare the certificate the server presents (openssl s_client) with the one you installed.
  • For the sibling bug, grep teamcity-javaLogging logs for ;.jsp and jsp= and review admin accounts, access tokens and plugins.

What happened#

On March 4, 2024, JetBrains disclosed two bugs in TeamCity On-Premises, both reported by Rapid7 and fixed in 2023.11.4. CVE-2024-27198 is an authentication bypass (CVSS 9.8) that gives full admin control. This brief covers its sibling, CVE-2024-27199, a relative path traversal (CWE-23). JetBrains, as CNA, scores it CVSS 3.1 7.3 on the CVE record, which says it allowed "limited admin actions."

Rapid7's write-up explains it. Some paths, such as /res/, /update/ and /.well-known/acme-challenge/, skipped authentication. Adding ../ reached protected pages behind them. With no login, an attacker could read /admin/diagnostic.jsp (Java and Tomcat versions, JVM arguments), upload an HTTPS certificate of their choice through /app/https/settings/uploadCertificate, or change the HTTPS port. Rapid7 notes this enables denial of service and, from the right network position, interception of traffic. Rapid7 published full details the same day, after JetBrains shipped the fix without coordinating with it.

CISA added CVE-2024-27198 to KEV on March 7, 2024. Trend Micro then reported attackers using it to deploy Jasmin ransomware, XMRig, SparkRAT and Cobalt Strike. CVE-2024-27199 followed only on April 20, 2026, when CISA added it to the KEV catalog with a May 4 deadline and marked ransomware use as "Known." CISA did not say what it saw. The Hacker News wrote that it is not known whether the two bugs are being exploited together. As of Oct 23, 2026, the public evidence behind the listing has not been disclosed.

Who is affected#

All TeamCity On-Premises versions through 2023.11.3. JetBrains patched TeamCity Cloud before disclosure and said it verified Cloud servers were not attacked. For servers that could not upgrade, JetBrains released a security patch plugin. It fixes only these two bugs.

Do you really need to act?#

Most teams patched in March 2024, so the verdict today is check exposure. On its own, this bug is limited: a recon leak, a certificate swap and a port change. The real risk is the server it signals. A TeamCity server still on 2023.11.3 or older is also open to CVE-2024-27198 and to CVE-2026-63077, an unauthenticated RCE fixed in 2025.11.7 and 2026.1.3 that ransomware crews exploit. A server patched only with the 2024 plugin is still exposed to the 2026 bug. CI servers hold source code, signing keys and deploy credentials, so a compromise there can spread downstream.

What to do now#

  1. List every TeamCity On-Premises server and note its version from the page footer or curl -s -H "Authorization: Bearer $TOKEN" https://teamcity.example.com/app/rest/server.
  2. Upgrade anything below 2025.11.7 or 2026.1.3 to a current release.
  3. Put the server behind a VPN or an IP allowlist.
  4. Confirm the served certificate is yours: openssl s_client -connect teamcity.example.com:443 </dev/null | openssl x509 -noout -fingerprint -sha256 -issuer -enddate.
  5. If the server was reachable and unpatched in March 2024, run the checks below and rotate every VCS token, cloud key and deploy credential it stores.

How to tell if you were hit#

  • Search reverse-proxy logs for /res/../, /update/../ and /.well-known/acme-challenge/../, including URL-encoded dots, and for unexpected calls to /app/https/settings/uploadCertificate, setPort or removeCertificate.
  • Check whether the HTTPS certificate or port changed without a ticket.
  • For CVE-2024-27198, Rapid7 lists teamcity-javaLogging entries containing ;.jsp and jsp=. Also review admin accounts, access tokens and plugins.
  • Trend Micro saw java.exe spawning cmd.exe and PowerShell, discovery commands such as nltest /domain_trusts, and attempts to add a local administrator named Default$.

Timeline#

  • — Rapid7 contacts JetBrains.
  • — TeamCity 2023.11.4 is released, per Rapid7.
  • — JetBrains publishes its advisory; the CVEs and Rapid7's full details go public.
  • — CISA adds CVE-2024-27198 to KEV.
  • — Trend Micro reports ransomware and malware deployed through CVE-2024-27198.
  • — CISA adds CVE-2024-27199 to KEV, due May 4.
  • — JetBrains discloses CVE-2026-63077.

Vulnerability records

  • CVE-2024-27199 · KEV 2026-04-20 · In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. JetBrains — Additional Critical Security Issues Affecting TeamCity On-Premises (CVE-2024-27198 and CVE-2024-27199): Update to 2023.11.4 Now blog.jetbrains.com
  2. Rapid7 — CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (FIXED) rapid7.com
  3. CVE record — CVE-2024-27199 cve.org
  4. NVD — CVE-2024-27199 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2024-27199 cisa.gov
  6. CVE record — CVE-2024-27198 cve.org
  7. CVE record — CVE-2026-63077 cve.org
  8. Trend Micro — TeamCity Vulnerability Exploits Lead to Jasmin Ransomware, Other Malware Types trendmicro.com

Coverage and analysis

  1. The Hacker News — CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines thehackernews.com