Threat Intelligence / CVE / CVE-2024-27199

CVE-2024-27199 — Jetbrains Teamcity

CVSS v3.1 7.3 (HIGH) · EPSS 82.4% (higher than 99.2% of all scored CVEs) · Priority 7.6/10 · Published 2024-03-04

As of 2025-05-30, CVE-2024-27199 is a HIGH-severity vulnerability in Jetbrains Teamcity, CVSS v3.1 7.3, EPSS 82.4% (99.2th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2024-27199, most recently “Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign (CVE-2026-23760, CVE-2025-10035)”.

Last updated: 2025-05-30

What is CVE-2024-27199?

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

The record classifies CVE-2024-27199 under weakness classes CWE-23, CWE-22. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 923 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 7.3 — HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS (FIRST): 82.4% probability of exploitation in the next 30 days, higher than 99.2% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 7.6/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2024-03-04, last modified 2025-05-30

Is CVE-2024-27199 being exploited?

It currently carries a trending score of 30 in the Threadlinqs vulnerability feed.

Affected products and versions

Jetbrains: Teamcity

How to fix CVE-2024-27199

Vendor advisory: https://www.jetbrains.com/privacy-security/issues-fixed/. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

Threat activity tracking CVE-2024-27199

1 tracked threat in the Threadlinqs corpus references CVE-2024-27199, either in the campaign’s CVE list or as an indicator on the campaign record.

Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign (CVE-2026-23760, CVE-2025-10035) — CRITICAL · 2026-04-06

Sources

Seeded from nvd and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.

Full detection coverage & IOCs for threats exploiting CVE-2024-27199 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence