CVE-2024-27199

Description

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

Scoring

• CVSS: 7.3 (HIGH, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2026-04-20
• Remediation due date: 2026-05-04
• Known ransomware campaign use: Known

Weakness types (CWE)

• CWE-23
• CWE-22

References

• https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
• https://www.jetbrains.com/privacy-security/issues-fixed/
• https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
• https://www.jetbrains.com/privacy-security/issues-fixed/
• https://github.com/Stuub/RCity-CVE-2024-27198/blob/main/RCity.py
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27199

More from JetBrains

• CVE-2026-63077 — TeamCity
• CVE-2024-27198 — TeamCity
• CVE-2023-42793 — TeamCity