A relative path traversal vulnerability in JetBrains TeamCity, confirmed exploited and carrying CISA's confirmed ransomware flag, was added to the KEV catalogue in April 2026 — a finding that puts a widely deployed CI/CD build server directly in ransomware operators' active toolkit.
CVE-2024-27199 — CVSS 7.3, HIGH, confirmed ransomware use, added to KEV 20 April 2026.
Why "limited admin actions" undersells what this bug actually enables
NVD's description of CVE-2024-27199 is almost understated: path traversal in TeamCity before 2023.11.4 "allowing to perform limited admin actions." Read in isolation, "limited admin actions" sounds like a minor privilege boundary issue. Read alongside CISA's confirmed ransomware flag, it means the limitation didn't stop real-world attackers from turning this into a usable foothold. A path traversal vulnerability in a CI/CD platform typically works by escaping the intended file or directory scope of a request and reaching configuration files, credentials, or administrative endpoints the vulnerability wasn't supposed to expose — and TeamCity, as a build server, holds exactly the kind of thing that matters most to an attacker once inside: source code access, build pipeline configuration, and often deployment credentials used to push artifacts into production environments.
This is the structural reason CI/CD infrastructure has become one of the highest-value target categories for ransomware operators over the past several years: a build server doesn't just hold data worth stealing, it holds the mechanism for inserting malicious code into legitimate software before it ships, and it typically holds credentials for every downstream system the build pipeline deploys to. "Limited admin actions" through a path traversal bug is a foothold that, combined with whatever else those admin actions expose, is evidently sufficient for ransomware groups to build a working attack chain around it.
What to check this week
Patch TeamCity to 2023.11.4 or later immediately if any instance in the environment predates that version — this is the exact fixed version NVD cites, and confirmed ransomware use means the exploitation window is not theoretical.
Audit TeamCity server logs for indicators of path traversal attempts, specifically requests containing directory-escape sequences targeting administrative endpoints, going back as far as log retention allows.
Review credentials and secrets accessible to the TeamCity build server, including deployment keys and any credentials used to push artifacts downstream, and rotate anything that may have been exposed if the server's patch history is uncertain.
Treat any internet-reachable TeamCity instance as a priority asset for this specific CVE, given that CI/CD servers are frequently more exposed than security teams assume, often for the practical reason that remote developers need to reach the build system.
Why CI/CD platforms are a ransomware target class, not an edge case
TeamCity joins a growing list of CI/CD and DevOps tooling vendors whose products have shown up in KEV with confirmed ransomware activity, and the pattern isn't coincidental. Build servers sit at a uniquely privileged junction point: they have read access to source code, write access to build artifacts, and typically hold long-lived credentials to whatever infrastructure the pipeline deploys into — a combination that makes a single compromised build server equivalent to compromising the entire software supply chain it serves, from source to production. Ransomware groups that have adapted their playbooks to target this infrastructure specifically are making a rational choice given the leverage a single build-server compromise provides over the alternative of attacking individual endpoints one at a time.
A closing note on the gap between disclosure and confirmed ransomware use
CVE-2024-27199 was originally disclosed roughly two years before its April 2026 KEV addition, which mirrors a pattern seen repeatedly across this series: a vulnerability's initial disclosure date and its confirmed-exploited date can be separated by a significant gap, during which unpatched instances simply continue to exist in production, waiting for an opportunistic attacker to catch up to a bug the vendor already fixed.
Why the fix version matters more than the CVSS number alone
A 7.3 CVSS score places CVE-2024-27199 in the "high" rather than "critical" band, and taken in isolation that might suggest it belongs lower on a remediation priority list than a 9.8 or a perfect 10.0 finding elsewhere in an organization's backlog. The confirmed ransomware flag overrides that instinct: CISA's KEV catalogue doesn't add the ransomware designation speculatively, it reflects observed use by real ransomware operators in real incidents. A moderate-looking CVSS score attached to confirmed ransomware activity should outrank a higher-scored vulnerability with no such confirmation in any reasonable prioritization scheme, because the ransomware flag answers the question a CVSS score cannot: not just how bad could this be, but has this specific vulnerability already been used to cause the worst-case outcome in practice.
A final consideration on internet-facing development infrastructure
Organizations frequently reason about their internet-facing attack surface in terms of customer-facing applications and network perimeter devices, while treating internal developer tooling as implicitly lower-exposure simply because its intended users are internal staff rather than the public. TeamCity and platforms like it are commonly exposed to the internet anyway, whether deliberately to support remote and distributed engineering teams or inadvertently through a misconfigured network boundary, and this vulnerability's confirmed exploitation is a direct illustration of what that exposure costs when it goes unpatched. Any inventory exercise aimed at reducing internet-facing risk should explicitly include CI/CD and developer tooling rather than assuming it falls outside the traditional perimeter review.
How Safeguard helps
Safeguard's continuous inventory tracks CI/CD infrastructure like TeamCity with the elevated priority this asset class warrants, flagging version drift against confirmed-exploited, ransomware-associated CVEs like this one before an outdated build server becomes the entry point into an organization's entire software supply chain.
