JetBrains TeamCity path traversal flaw CVE-2024-27199 added to CISA's exploited list, used by ransomware gangs
CISA says attackers, including ransomware gangs, are using CVE-2024-27199, a path traversal flaw in self-hosted JetBrains TeamCity. The fix has existed since March 2024 in version 2023.11.4. Businesses running older TeamCity On-Premises servers should update now.
If your organisation runs its own TeamCity server, update TeamCity On-Premises to 2023.11.4 or later, then check it for unexpected new user accounts or changed settings. If you use TeamCity Cloud or don't use TeamCity, there is nothing to do.
What’s happening
On 20 April 2026 CISA added CVE-2024-27199, a relative path traversal flaw in JetBrains TeamCity On-Premises, to its list of vulnerabilities being used in attacks and flagged it as used in ransomware. The bug sits in how TeamCity checks requests. It lets an outsider reach some protected functions without signing in, such as certificate upload and web port settings. It does not give full administrator control; that belongs to a companion flaw, CVE-2024-27198, disclosed at the same time. JetBrains fixed both on 4 March 2024 in TeamCity 2023.11.4, and also offered a security patch plugin for servers that could not upgrade straight away. TeamCity Cloud was patched by JetBrains and was not affected. Secondary reports say attackers, including a ransomware group called BianLian, used the two flaws together, with CVE-2024-27198 usually giving the first way in. The reports do not show how many of those attacks relied on CVE-2024-27199 itself. This is a business build-server product, not a consumer app. We could not read JetBrains' own advisory pages directly, so the fixed version comes from press reports of the vendor's statement.
- What
- Flaw
- Affects
- JetBrains TeamCity On-Premises (self-hosted build server)
- Affected
- JetBrains TeamCity On-Premises before 2023.11.4
- Fixed in
- TeamCity 2023.11.4
- Since
- 20 Apr 2026
- Closed
- 20 Apr 2026
Timeline
- CISA added
CISA added CVE-2024-27199 to its list of flaws used in attacks, with a federal remediation deadline of 4 May 2026. The listing is flagged as used in ransomware; one secondary report ties earlier exploitation to BianLian and Jasmin ransomware, while noting CVE-2024-27198 usually provided the initial access.
- Wider attacks
Attacks on the companion flaw CVE-2024-27198 were reported at large scale, with LeakIX counting 1,442 of 1,711 vulnerable servers showing signs of rogue user creation. Some reports linked follow-on deployments of suspected modified Jasmin ransomware.
- Made publicFixed
JetBrains disclosed and fixed two TeamCity On-Premises flaws, CVE-2024-27198 and CVE-2024-27199, in version 2023.11.4. TeamCity Cloud had already been patched.
Sources
- TeamCity CVE-2024-27199: two years to KEVPatch Day Alert · 20 Apr 2026
- JetBrains TeamCity vulnerabilities CVE-2024-27198 and CVE-2024-27199 (exploitation and fix)Help Net Security · 7 Mar 2024