JetBrains Cadence Breach Exposes AWS Credentials via Unpatched TeamCity Flaw
Critical vulnerability exploited to access cloud service credentials and source code.
1Critical Security Incident
JetBrains has alerted Cadence users to revoke all credentials after attackers exploited a critical vulnerability (CVE-2026-63077, CVSS 9.8) in TeamCity to breach its cloud service. The flaw allowed unauthenticated attackers to execute arbitrary commands with TeamCity server privileges. The breach occurred between August 8-24, 2026, with the compromised server (api.cadence.jetbrains.com) now offline. JetBrains admitted the server should have been patched but didn't explain why it wasn't.
2Exposed Data Details
Attackers accessed Cadence server backups from 2024, potentially compromising current user data including email addresses, project source code, and credentials. They may have also accessed source code synchronized from PyCharm projects. JetBrains confirmed the breach didn't affect additional users beyond those previously notified. The company is treating all stored data as potentially exposed, warning of increased phishing and social engineering risks using the compromised information.
3Vulnerability Timeline
The critical TeamCity vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on August 5, 2026. JetBrains discovered active exploitation on August 23. The attack window was narrow (August 8-24), but the impact is significant due to the high-privilege access gained. The flaw involves unsafe deserialization of untrusted data, allowing authentication bypass and command execution. This marks another high-profile case of unpatched systems leading to major breaches.
4Immediate User Actions
JetBrains mandates credential rotation and recommends treating all Cadence executions as untrusted. Users must audit AWS accounts, S3 buckets, deployment environments, and package registries for suspicious activity. Source code repositories need review for unauthorized changes during the breach period. The company has invalidated all Cadence plugin access tokens in PyCharm. These measures aim to contain potential lateral movement using stolen credentials.
5Cloud Service Context
Cadence is JetBrains' cloud computing service that integrates with PyCharm via plugin, enabling developers to run ML workloads on cloud GPUs directly from their IDE. The breach highlights risks in developer toolchains becoming attack vectors. With access to Cadence environments, attackers could potentially compromise entire development pipelines. This incident underscores the expanding attack surface in cloud-native development environments.
6Enterprise Implications
The breach demonstrates how vulnerabilities in CI/CD infrastructure can cascade across an organization's tech stack. TeamCity servers often hold privileged access to multiple systems, making them high-value targets. JetBrains' delayed patch response mirrors challenges many enterprises face in vulnerability management. The incident will likely accelerate adoption of zero-trust principles in developer tools and stricter credential rotation policies.
7Industry Response
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) quickly cataloged the vulnerability after its disclosure. Security experts note this exploit follows a pattern of attackers increasingly targeting developer tools and build systems. The cybersecurity community is emphasizing the need for better vulnerability prioritization, especially with AI-powered attacks reducing exploit development time from weeks to minutes.
8Long-term Security Lessons
This breach reinforces three critical security principles: timely patching of high-severity vulnerabilities, minimizing credential exposure in automated systems, and implementing robust backup access controls. Organizations must balance development velocity with security, particularly in cloud-based developer tools. The incident serves as a wake-up call for better vulnerability response coordination between security and development teams.