CVE-2023-42793JetBrains TeamCity 2023 authentication bypass to RCE
What broke
TeamCity On-Premises before 2023.05.4 accepted an unauthenticated request that created an administrator token, then ran code. Discovered by Sonar. CVSS 9.8. Published 19 September 2023. CISA later confirmed Russian state use from that month. Cloud was not affected.
Why it matters
This is the CVE that taught a lot of identity and AppSec teams that CI credentials are production identity. CVE-2024-27198 and our 2026 TeamCity note are sequels. If you still have a public TeamCity, this history is your briefing.
What to do
- You should already be far past 2023.05.4. If a forgotten 2023.x appliance is still up, take it down and rotate every secret it held.
- Review admin users and SSH agent keys created in September 2023.
- Keep TeamCity off the internet. The 2024 and 2026 IDs assume you did not learn this once.
After you patch
A build system holds the credentials to ship your software, so an unauthenticated bypass here is a software supply chain event rather than one compromised host.
- Rotate every secret the server held: signing keys, registry and cloud credentials, deploy tokens, and any service account it authenticated as.
- Review build history for injected steps during the exposure window, and compare published artifacts against expected hashes.
- Revoke sessions and administrative tokens rather than only resetting passwords.
- Check for accounts and API tokens created during the window, which is the standard persistence step after this class of bypass.
Sources
- NVD: CVE-2023-42793
- CISA KEV / December 2023 update
- Sonar / JetBrains advisories
Related identity CVEs
Related on Start with Identity
- CVETeamCity agent-polling protocol authentication bypass to RCE
Every on-premises TeamCity version was vulnerable. An unauthenticated attacker abuses the agent polling channel and runs OS commands as the server. Fixed 27 Jul
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a