Every CVE Search/ Get API key

CVE-2024-27198

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions...

9.8 CriticalIn KEVPublic exploit

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.9%Up 99.9 points since Mar 5, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.8

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

Record
CVE-2024-27198
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-288
Updated
2026-11-02
EUVDEUVD-2024-24437 9.8

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

Record
EUVD-2024-24437
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-xh94-49wq-7h2h 9.8

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions...

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

Record
GHSA-xh94-49wq-7h2h
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-288
Updated
2026-11-02
CISA KEV No score

JetBrains TeamCity Authentication Bypass Vulnerability

JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.

Record
CVE-2024-27198
Weakness
CWE-288
Updated
2026-11-02
NVD 9.8

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

Record
CVE-2024-27198
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-288
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubChocapikk/CVE-2024-271982024-03-04
MetasploitJetBrains TeamCity Unauthenticated Remote Code Execution2024-03-04
PoC in GitHubyoryio/CVE-2024-271982024-03-05
PoC in GitHubW01fh4cker/CVE-2024-27198-RCE2024-03-06
PoC in GitHubrampantspark/CVE-2024-271982024-03-07
PoC in GitHubpasswa11/CVE-2024-27198-RCE2024-03-08
PoC in GitHubCharonDefalt/CVE-2024-27198-RCE2024-03-09
PoC in GitHubShimon03/Explora-o-RCE-n-o-autenticado-JetBrains-TeamCity-CVE-2024-27198-2024-04-02
PoC in GitHubStuub/RCity-CVE-2024-271982024-04-22
PoC in GitHubHPT-Intern-Task-Submission/CVE-2024-271982024-07-20
Show 12 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubjrbH4CK/CVE-2024-271982024-08-16
PoC in GitHubgeniuszly/CVE-2024-271982024-10-09
PoC in GitHubCythonic1/CVE-2024-27198_POC2024-10-14
PoC in GitHubArtemCyberLab/Project-Exploiting-CVE-2024-27198-RCE-Vulnerability2025-01-22
Exploit-DBJetBrains TeamCity 2023.11.4 - Authentication Bypass2025-08-11
PoC in GitHubEynaExp/CVE-2024-27198-POC2025-12-17
PoC in GitHubNe0zer01/CVE-2024-27198_LAB2026-05-18
PoC in GitHubptd200110/CVE-2024-27198-SOC-Lab2026-06-19
PoC in GitHubkxom9ks/CVE-2024-27198-TeamCity2026-07-24
PoC in GitHubGREATKID05/CVE-2024-27198-Assignment2026-10-19
PoC in GitHubwonnnggge/CVE-2024-27198_CTF2026-10-19
NucleiTeamCity < 2023.11.4 - Authentication Bypass

History

History
RecordedChangedSources
exploitsPoC in GitHub
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-27198 is a critical vulnerability (CVSS 9.8) in Jetbrains Teamcity, published March 4, 2024. CISA lists it as known to be exploited, since March 7, 2024. EUVD reports exploitation since March 7, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.9%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open