Threat actors are actively exploiting a critical vulnerability in TeamCity on-premises servers. TeamCity is a continuous integration and continuous delivery (CI/CD) server by JetBrains designed to automate building, testing, and deploying software. The flaw, tracked as CVE-2024-27198, is a critical authentication bypass vulnerability with a CVSS score of 9.8/10, affecting all TeamCity versions up to 2023.11.4. If successfully exploited, the vulnerability allows remote attackers to gain administrative control over vulnerable servers. The potential for supply-chain attacks is also high, as compromised servers could give attackers access to sensitive information and control over software builds and deployments. This widespread exploitation has led to the creation of hundreds of unauthorized users on unpatched TeamCity instances visible online. LeakIX has identified over 1,700 unpatched TeamCity servers, primarily located in Germany, the United States, and Russia, with over 1,440 instances already compromised. Exploitation patterns show the creation of users with 8-character alphanumeric usernames. GreyNoise observed a significant increase in exploitation attempts, particularly from the United States on DigitalOcean’s hosting infrastructure. JetBrains has released a patch in TeamCity 2023.11.4 and CTIX analysts urge administrators to update their installations immediately to mitigate the risk of exploitation.