JetBrains TeamCity Auth Bypass Vulnerability Exploited

On March 4, 2024 JetBrains released patches for two authentication-bypass vulnerabilities in TeamCity (CVE-2024-27198 — critical, and CVE-2024-27199 — high); Rapid7 published details and public exploits soon after, and Cyble observed active exploitation of CVE-2024-27198 from March 5, 2024 onward. The report notes 1,780 internet-exposed TeamCity instances, captured exploitation attempts in sensor data, a set of IoCs (multiple attacker IPs), and underground forum activity selling compromised TeamCity access; it recommends immediate patching, network segmentation, monitoring of TeamCity logs, and regular assessments.