--- title: "TeamCity CVE-2024-27199: Path Traversal Joins KEV in 2026" url: https://erroneo.us/security/briefs/teamcity-cve-2024-27199-path-traversal/ description: "TeamCity On-Premises through 2023.11.3 let unauthenticated users swap the HTTPS certificate. In KEV since April 2026 with ransomware use. Confirm upgrades." type: security-brief section: "Security Digest" date_published: 2024-03-04 date_modified: 2026-10-23 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2024-27199"] severity: "high" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # TeamCity CVE-2024-27199: Path Traversal Joins KEV in 2026 **Verdict: Check exposure.** Fixed since March 2024 alongside a critical sibling; confirm no TeamCity server is still on 2023.11.3 or older, move everything to a build that also fixes CVE-2026-63077, and hunt on servers that were exposed and unpatched in March 2024. - **Who must act:** Owners of self-hosted TeamCity servers still on 2023.11.3 or older, servers patched only with the 2024 plugin, and anyone whose server was internet-facing and unpatched in early March 2024. - **Who can relax:** TeamCity Cloud customers, and on-prem teams that upgraded in March 2024, are now on 2025.11.7, 2026.1.3 or later, and do not expose the server publicly. - **Affected:** TeamCity On-Premises, all versions through 2023.11.3 - **Fixed:** TeamCity 2023.11.4 (Mar 2024); Security patch plugin for versions through 2023.11.3 (fixes CVE-2024-27198 and CVE-2024-27199 only); Current releases; servers should now be on 2025.11.7, 2026.1.3 or later because of CVE-2026-63077 - **CVEs:** CVE-2024-27199 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Inventory every TeamCity On-Premises server and record its version from the web UI footer or GET /app/rest/server. 2. Upgrade anything older than 2025.11.7 or 2026.1.3 to a current release; the 2024 patch plugin covers only the March 2024 bugs. 3. Remove direct internet exposure: put TeamCity behind a VPN or an IP allowlist. 4. Check that the HTTPS certificate and port the server uses are the ones you configured. 5. If a server was exposed and unpatched in March 2024, hunt for CVE-2024-27198 activity too and rotate every secret it stores. ### How to check if you are affected - Search reverse-proxy logs for paths containing /res/../, /update/../ or /.well-known/acme-challenge/../, including URL-encoded dots. - Look for requests to /app/https/settings/uploadCertificate, setPort or removeCertificate that your admins did not make. - Compare the certificate the server presents (openssl s_client) with the one you installed. - For the sibling bug, grep teamcity-javaLogging logs for ;.jsp and jsp= and review admin accounts, access tokens and plugins. ## What happened On March 4, 2024, JetBrains [disclosed two bugs](https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/) in TeamCity On-Premises, both reported by Rapid7 and fixed in 2023.11.4. [CVE-2024-27198](https://www.cve.org/CVERecord?id=CVE-2024-27198) is an authentication bypass (CVSS 9.8) that gives full admin control. This brief covers its sibling, CVE-2024-27199, a relative path traversal (CWE-23). JetBrains, as CNA, scores it CVSS 3.1 7.3 on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-27199), which says it allowed "limited admin actions." [Rapid7's write-up](https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/) explains it. Some paths, such as `/res/`, `/update/` and `/.well-known/acme-challenge/`, skipped authentication. Adding `../` reached protected pages behind them. With no login, an attacker could read `/admin/diagnostic.jsp` (Java and Tomcat versions, JVM arguments), upload an HTTPS certificate of their choice through `/app/https/settings/uploadCertificate`, or change the HTTPS port. Rapid7 notes this enables denial of service and, from the right network position, interception of traffic. Rapid7 published full details the same day, after JetBrains shipped the fix without coordinating with it. CISA added CVE-2024-27198 to KEV on March 7, 2024. [Trend Micro](https://www.trendmicro.com/en_us/research/24/c/teamcity-vulnerability-exploits-lead-to-jasmin-ransomware.html) then reported attackers using it to deploy Jasmin ransomware, XMRig, SparkRAT and Cobalt Strike. CVE-2024-27199 followed only on April 20, 2026, when CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27199) with a May 4 deadline and marked ransomware use as "Known." CISA did not say what it saw. [The Hacker News](https://thehackernews.com/2026/04/cisa-adds-8-exploited-flaws-to-kev-sets.html) wrote that it is not known whether the two bugs are being exploited together. As of Oct 23, 2026, the public evidence behind the listing has not been disclosed. ## Who is affected All TeamCity On-Premises versions through 2023.11.3. JetBrains patched TeamCity Cloud before disclosure and said it verified Cloud servers were not attacked. For servers that could not upgrade, JetBrains released a security patch plugin. It fixes only these two bugs. ## Do you really need to act? Most teams patched in March 2024, so the verdict today is check exposure. On its own, this bug is limited: a recon leak, a certificate swap and a port change. The real risk is the server it signals. A TeamCity server still on 2023.11.3 or older is also open to CVE-2024-27198 and to [CVE-2026-63077](https://www.cve.org/CVERecord?id=CVE-2026-63077), an unauthenticated RCE fixed in 2025.11.7 and 2026.1.3 that ransomware crews exploit. A server patched only with the 2024 plugin is still exposed to the 2026 bug. CI servers hold source code, signing keys and deploy credentials, so a compromise there can spread downstream. ## What to do now 1. List every TeamCity On-Premises server and note its version from the page footer or `curl -s -H "Authorization: Bearer $TOKEN" https://teamcity.example.com/app/rest/server`. 2. Upgrade anything below 2025.11.7 or 2026.1.3 to a current release. 3. Put the server behind a VPN or an IP allowlist. 4. Confirm the served certificate is yours: `openssl s_client -connect teamcity.example.com:443