CVE-2024-27198
JetBrains TeamCity Authentication Bypass Vulnerability
- Published
- Mar 4, 2024
- Updated
- Oct 21, 2025
- Assigning CNA
- JetBrains
- Evidence observed
- Mar 7, 2024
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 100.0%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
Sources
20- CVE-2024-27198-RCEExploit
Exploit for JetBrains TeamCity authentication bypass (CVE-2024-27198) enabling remote code execution, with webshell upload and connection capabilities.
Lab for the CVE-2024-27198
- CVE-2024-27198-POCExploit
proof-of-concept mass scanner targeting JetBrains TeamCity instances affected by CVE-2024-27198
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.