CISA Warns of Active Exploitation of JetBrains TeamCity Flaw by Ransomware Gangs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that ransomware gangs are now exploiting a critical JetBrains TeamCity vulnerability that was patched in July 2024. The vulnerability, identified as CVE-2024-27198, is a critical authentication bypass and remote code execution flaw. Although JetBrains released a patch last July, CISA's emergency directive indicates that threat actors have begun actively exploiting the flaw. The agency has mandated that federal agencies either apply the security update immediately or disconnect affected TeamCity servers from their networks. The exploitation of this vulnerability poses significant risks, including potential ransomware deployment, unauthorized access to build servers, and lateral movement into connected networks. CISA's alert underscores the urgency of patching, noting that the window between vulnerability disclosure and active exploitation by ransomware groups has narrowed. JetBrains has been contacted for comment on the active exploitation reports.