CVE-2023-42793

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

First PoC 2023-09-29
982 days →Metasploit 2026-06-06
132 days →First cited attacker 2026-10-17

Exploited in the wild: Yesadded 2023-10-04 · due 2023-10-25 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

20 known · links only

GitHub PoCs · by trust, then stars17

H454NSec/CVE-2023-42793 ↗Trust ok 100
JetBrains TeamCity Authentication Bypass CVE-2023-42793 Exploit
★ 45 · created 2023-09-29
B4l3rI0n/CVE-2023-42793 ↗Trust ok 100
JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE), CVE-2023-42793
★ 11 · created 2024-04-24
Zenmovie/CVE-2023-42793 ↗Trust ok 100
PoC of CVE-2023-42793
★ 9 · created 2023-10-05
hotplugin0x01/CVE-2023-42793 ↗Trust ok 100
JetBrains TeamCity Unauthenticated Remote Code Execution - Python3 POC
★ 2 · created 2024-04-21
hhesenjan/CVE-2023-42793 ↗Trust ok 100
TeamCity RCE for Linux (CVE-2023-42793)
★ 1 · created 2024-07-05
junnythemarksman/CVE-2023-42793 ↗Trust ok 100
TeamCity CVE-2023-42793 exploit written in Rust
★ 1 · created 2024-05-27
SwiftSecur/teamcity-exploit-cve-2023-42793 ↗Trust ok 100
teamcity-exploit-cve-2023-42793
★ 1 · created 2024-09-20
syaifulandy/Nuclei-Template-CVE-2023-42793.yaml ↗Trust ok 100
Windows & linux support
★ 1 · created 2025-05-11
becrevex/CVE-2023-42793 ↗Trust ok 100
TeamCity server scanner to detect CVE-2023-42793
★ 0 · created 2024-10-08
burakacar6/CVE-2023-42793-TeamCity-Unauthenticated-RCE ↗Trust ok 100
A PoC and automated version detection/exploit tool for JetBrains TeamCity Authentication Bypass & RCE (CVE-2023-42793).
★ 0 · created 2026-09-05
cxdxnt/CVE-2023-42793 ↗Trust ok 100
TeamCity 2023.05.3 - CVE-2023-42793 - Create username administrator.
★ 0 · created 2025-11-27
DDestinys/CVE-2023-42793 ↗Trust ok 100
★ 0 · created 2026-01-06
FlojBoj/CVE-2023-42793 ↗Trust ok 100
TeamCity CVE-2023-42793 RCE (Remote Code Execution)
★ 0 · created 2024-08-24
jakehomb/cve-2023-42793 ↗Trust ok 100
★ 0 · created 2025-04-14
johnossawy/CVE-2023-42793_POC ↗Trust ok 100
★ 0 · created 2024-01-07
StanleyJobsonAU/GhostTown ↗Trust ok 100
Proof of Concept script to exploit CVE-2023-42793 (TeamCity)
★ 0 · created 2024-01-15
whoamins/CVE-2023-42793 ↗Trust ok 100
★ 0 · created 2023-10-05

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit1

JetBrains TeamCity Unauthenticated Remote Code Execution ↗
This module exploits an authentication bypass vulnerability to achieve unauthenticated remote code execution against a vulnerable JetBrains TeamCity server. All versions of TeamCity prior to version 2023.05.4 are vulnerable to this issue. The vulnerability was originally discovered by SonarSource.
ruby · seen 2026-10-18

Exploit-DB1

JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE) ↗
created 2024-03-14

Nuclei1

JetBrains TeamCity < 2023.05.4 - Remote Code Execution ↗
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Cited as exploited by

Silent Chollima
1. “Since early October 2023, Microsoft has observed North Korean nation-state threat actors Diamond Sleet and Onyx Sleet exploiting the Jet Brains TeamCity CVE-2023-42793 remote-code execution vulnerability.”
  cited as exploiting · source: techcommunity.microsoft.com ↗ · 2026-10-17
2. “Since early October 2023, Microsoft has observed two North Korean nation-state threat actors – Diamond Sleet and Onyx Sleet – exploiting CVE-2023-42793, a remote-code execution vulnerability affecting multiple versions of JetBrains TeamCity server.”
  cited as exploiting · source: microsoft.com ↗ · 2026-10-17
3. “Since early October 2023, Microsoft has observed North Korean nation-state threat actors Diamond Sleet and Onyx Sleet exploiting the Jet Brains TeamCity CVE-2023-42793 remote-code execution vulnerability.”
  cited as exploiting · source: techcommunity.microsoft.com ↗ · 2026-10-17
Lazarus Group
1. “Since early October 2023, Microsoft has observed North Korean nation-state threat actors Diamond Sleet and Onyx Sleet exploiting the Jet Brains TeamCity CVE-2023-42793 remote-code execution vulnerability.”
  cited as exploiting · source: techcommunity.microsoft.com ↗ · 2026-10-17
2. “Since early October 2023, Microsoft has observed two North Korean nation-state threat actors – Diamond Sleet and Onyx Sleet – exploiting CVE-2023-42793, a remote-code execution vulnerability affecting multiple versions of JetBrains TeamCity server.”
  cited as exploiting · source: microsoft.com ↗ · 2026-10-17
3. “Since early October 2023, Microsoft has observed North Korean nation-state threat actors Diamond Sleet and Onyx Sleet exploiting the Jet Brains TeamCity CVE-2023-42793 remote-code execution vulnerability.”
  cited as exploiting · source: techcommunity.microsoft.com ↗ · 2026-10-17
APT29
1. “warned that APT29 has been exploiting an authentication bypass vulnerability (CVE-2023-42793) in TeamCity.”
  cited as exploiting · source: ics-cert.kaspersky.com ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals