In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

1. 2024-03-04 CISA SSVC: exploitation active
2. 2024-03-04 First public exploit (Metasploit exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198)
3. 2024-03-04 Published
4. 2026-04-20 Added to CISA KEV
5. 2026-05-04 CISA patch deadline

Added

6 mo ago (2026-04-20)

Patch by

2026-05-04 (6 mo ago)

Ransomware

Known to be used in ransomware campaigns

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor, product

JetBrains, TeamCity

CISA name

JetBrains TeamCity Relative Path Traversal Vulnerability

Exploitation

Active, exploited in the wild

Automatable

yes

Technical impact

partial

Assessed

2 y ago (2024-03-04)

99.99% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Metasploit exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198 JetBrains TeamCity Unauthenticated Remote Code Execution metasploit exploit, excellent rank, 2024-03-04
• Nuclei template TeamCity < 2023.11.4 - Authentication Bypass nuclei detection template
• github.com https://github.com/Stuub/RCity-CVE-2024-27198/blob/main/RCity.py referenced PoC, tagged "exploit" by a source, unverified

• JetBrains TeamCity

Weakness

• CWE-23 Relative Path Traversal
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory

• github.com /Stuub/RCity-CVE-2024-27198/blob/main/RCity.py

  exploit

• jetbrains.com /privacy-security/issues-fixed/

  vendor-advisory

• darkreading.com /cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive

  press/media-coverage

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27199

  government-resource, us-government-resource

• CVE List CVE-2024-27199
• NVD CVE-2024-27199

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.