CVE-2023-42793

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server...

9.8 CriticalIn KEVPublic exploit

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

100.0%Up 99.9 points since Sep 20, 2023

What each source reports

CVE List Score used 9.8

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Record: CVE-2023-42793
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-288
Updated: 2026-11-02

EUVDEUVD-2023-47222 9.8

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Record: EUVD-2023-47222
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-w796-2gq9-7jm8 9.8

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server...

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Record: GHSA-w796-2gq9-7jm8
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-288, CWE-306
Updated: 2026-11-02

CISA KEV No score

JetBrains TeamCity Authentication Bypass Vulnerability

JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.

Record: CVE-2023-42793
Weakness: CWE-288
Updated: 2026-11-02

NVD 9.8

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Record: CVE-2023-42793
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-288, CWE-306
Updated: 2026-11-02

Affected products

jetbrains teamcity

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	JetBrains TeamCity Unauthenticated Remote Code Execution	2023-09-19
PoC in GitHub	H454NSec/CVE-2023-42793	2023-09-29
PoC in GitHub	Zenmovie/CVE-2023-42793	2023-10-05
PoC in GitHub	whoamins/CVE-2023-42793	2023-10-05
PoC in GitHub	johnossawy/CVE-2023-42793_POC	2024-01-07
PoC in GitHub	StanleyJobsonAU/GhostTown	2024-01-15
Exploit-DB	JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE)	2024-03-14
PoC in GitHub	hotplugin0x01/CVE-2023-42793	2024-04-21
PoC in GitHub	B4l3rI0n/CVE-2023-42793	2024-04-24
PoC in GitHub	junnythemarksman/CVE-2023-42793	2024-05-27

Show 10 moreShow less

Public exploits
Source	Link	Date
PoC in GitHub	hhesenjan/CVE-2023-42793	2024-07-05
PoC in GitHub	FlojBoj/CVE-2023-42793	2024-08-24
PoC in GitHub	SwiftSecur/teamcity-exploit-cve-2023-42793	2024-09-20
PoC in GitHub	becrevex/CVE-2023-42793	2024-10-08
PoC in GitHub	jakehomb/cve-2023-42793	2025-04-14
PoC in GitHub	syaifulandy/Nuclei-Template-CVE-2023-42793.yaml	2025-05-11
PoC in GitHub	cxdxnt/CVE-2023-42793	2025-11-27
PoC in GitHub	DDestinys/CVE-2023-42793	2026-01-06
PoC in GitHub	burakacar6/CVE-2023-42793-TeamCity-Unauthenticated-RCE	2026-09-05
Nuclei	JetBrains TeamCity < 2023.05.4 - Remote Code Execution

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-42793 is a critical vulnerability (CVSS 9.8) in Jetbrains Teamcity, published September 19, 2023. CISA lists it as known to be exploited, since October 4, 2023. EUVD reports exploitation since October 4, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.

References

Show 4 moreShow less