JetBrains Cadence Breached Through Unpatched TeamCity Flaw, Exposing AWS Credentials

The intrusion affected JetBrains' Cadence service, a cloud computing platform integrated with PyCharm that allows developers to execute workloads on cloud infrastructure. The attack took place between August 8 and August 24, 2026, with JetBrains discovering the exploitation on August 23.

The incident is particularly notable because the compromised TeamCity server should have been patched against the vulnerability but was not.

Executive Summary

1. Threat Level: 🔴 Critical
2. Affected Service: JetBrains Cadence
3. Attack Vector: Exploitation of vulnerable TeamCity server
4. Vulnerability: CVE-2026-63077
5. CVSS Score: 9.8
6. Attack Type: Remote code execution / Credential theft
7. Affected Period: August 8–24, 2026
8. Threat Actor: Unidentified
9. Compromised Server: api.cadence.jetbrains.com

JetBrains has taken the affected Cadence server offline and invalidated access tokens associated with the Cadence PyCharm plugin. The company is urging users to immediately revoke and rotate credentials and secrets that may have been accessible through Cadence.

Key Takeaways

• Attackers exploited CVE-2026-63077, a critical TeamCity vulnerability rated CVSS 9.8.
• The vulnerability can allow an unauthenticated attacker to bypass authentication and execute operating-system commands on a vulnerable TeamCity server.
• JetBrains confirmed that its Cadence environment was vulnerable and was successfully exploited.
• Attackers accessed a 2024 Cadence server backup containing potentially sensitive credentials, configuration, artifacts and logs.
• Multiple AWS IAM users and associated credentials/secrets were compromised.
• Files stored in S3 buckets belonging to JetBrains' AWS environment were also accessed.
• Personal information, including usernames, names, email addresses, login timestamps and IP addresses, was exposed.
• Source code synchronized from PyCharm projects to Cadence may also have been accessible.
• JetBrains says affected users should treat credentials and Cadence executions as potentially compromised.

What Is JetBrains Cadence?

Cadence is a JetBrains-hosted cloud computing service designed to allow developers to run workloads on cloud resources.

The service integrates with PyCharm through an optional plugin, enabling developers to execute projects on cloud infrastructure, including workloads requiring significant computing resources. TeamCity was used within the Cadence environment to orchestrate these workloads.

Because Cadence can interact with external services and cloud resources, credentials used by executions can potentially provide access to source repositories, cloud storage, package registries and other development infrastructure.

That makes a compromise of the Cadence environment particularly significant.

The Vulnerability Behind the Attack

The attackers exploited CVE-2026-63077, a critical vulnerability affecting JetBrains TeamCity.

The flaw is described as a deserialization of untrusted data vulnerability. Under the relevant conditions, an unauthenticated attacker with network access to a vulnerable TeamCity server could bypass authentication protections and execute arbitrary operating-system commands with the privileges of the TeamCity server process.

1. CVE: CVE-2026-63077
2. CVSS: 9.8 — Critical
3. Impact: Authentication bypass and arbitrary command execution

The vulnerability was subsequently added to the CISA Known Exploited Vulnerabilities catalog, highlighting the urgency surrounding exploitation of affected TeamCity installations.

How the Attack Unfolded

The incident followed a chain that began with the vulnerable TeamCity infrastructure.

1. Vulnerable TeamCity Server

The Cadence environment contained a TeamCity server that had not been patched against CVE-2026-63077.

JetBrains acknowledged that the server should have been patched as part of its response to the vulnerability but was not.

2. Initial Compromise

Threat actors exploited the TeamCity vulnerability to gain unauthorized access to the Cadence environment.

JetBrains identified malicious activity beginning on August 8, 2026.

3. Access to Cadence Infrastructure

After gaining access, the attackers were able to interact with the Cadence server and access sensitive information stored within the environment.

4. Backup Compromise

One of the most significant findings was unauthorized access to a full Cadence server backup from 2024.

The backup potentially contained:

• Credentials
• Configuration information
• Build artifacts
• Logs
• Secrets
• Other server data

5. AWS Credential Theft

Attackers compromised multiple AWS IAM users and associated credentials and secrets used with Cadence.

Some of these credentials belonged to JetBrains employees who used the service.

The incident therefore extended beyond the Cadence server itself and potentially exposed access to connected cloud resources.

What Data Was Exposed?

JetBrains confirmed that attackers accessed several categories of information.

Personal Information

Exposed personal data includes:

• Usernames
• Real names
• Email addresses
• Last-login timestamps
• Last accessed IP addresses

This information could be used to conduct targeted phishing, impersonation and social-engineering campaigns.

AWS Credentials

Multiple AWS IAM users and credentials associated with Cadence were compromised.

Organizations should therefore assume that any cloud credentials used within affected Cadence executions could have been exposed.

S3 Data

Attackers also accessed files stored in S3 buckets within JetBrains AWS accounts used by Cadence.

JetBrains said it was still determining the full scope of the data accessed. The company also noted that some users may have configured Cadence to access their own storage buckets.

Source Code

Source code synchronized from PyCharm projects to the affected Cadence server may also have been accessible.

This is particularly important for developers who uploaded project files for execution through Cadence.

Source code may contain more than application logic. Developers sometimes unintentionally store:

• API keys
• Cloud credentials
• Database passwords
• Service tokens
• Configuration secrets
• Internal endpoints

Consequently, affected users should treat synchronized project data as potentially compromised.

**JetBrains Response
**
JetBrains discovered the exploitation on August 23 and took the affected Cadence server offline on August 24, 2026.

The company has also:

• Invalidated Cadence plugin access tokens.
• Taken the affected server offline.
• Investigated the compromised environment.
• Notified affected users.
• Assessed potentially exposed customer data.
• Advised users to revoke and rotate credentials.
• Provided indicators of compromise for security teams.

JetBrains subsequently stated that its investigation had concluded, while maintaining the same recommended actions for affected users.

What Cadence Users Should Do

JetBrains recommends that users take immediate action to protect connected systems.

1. Revoke and Rotate Credentials

Users should revoke and replace credentials and secrets that may have been used by Cadence executions.

This includes:

• AWS credentials
• Azure credentials
• Google Cloud credentials
• GitHub tokens
• GitLab tokens
• Bitbucket credentials
• Package repository credentials
• Container registry credentials
• API tokens
• SSH keys
• Deployment keys
• Service-account credentials
• Signing keys and certificates

2. Review Cloud Accounts

Organizations should examine AWS, Azure and Google Cloud environments for suspicious activity.

Pay particular attention to:

• New IAM users
• Modified IAM policies
• New access keys
• Unexpected role changes
• Unusual API activity
• Unexpected S3 access
• New service accounts
• Unusual geographic activity

3. Audit Source Repositories

Security teams should investigate repositories connected to Cadence for:

• Unexpected clones or downloads
• Unauthorized commits
• Modified repository secrets
• New collaborators
• Changed permissions
• New personal access tokens
• Unexpected SSH keys
• Modified webhooks

4. Review Package and Container Registries

Teams should also inspect package repositories and container registries for unexpected activity.

Look for:

• New packages
• Modified packages
• Unexpected releases
• Unauthorized container images
• Changes to publishing credentials

5. Treat Cadence Executions as Untrusted

JetBrains advises users to treat Cadence executions, inputs and outputs as potentially untrusted.

This is important because malicious modifications to an execution environment could potentially affect downstream systems.

Indicators of Compromise

JetBrains has identified several indicators that organizations can use during investigation.

Security teams should review activity beginning August 8, 2026, particularly activity involving credentials previously stored in or accessible through Cadence.

Reported malicious IP addresses include:

• 150.109.230.104
• 43.153.227.206
• 62.210.127.48
• 210.247.242.190
• 15.235.225.205
• 152.233.30.18

Organizations should correlate these indicators with:

CloudTrail → IAM → S3 → Source Control → CI/CD → Endpoint → Authentication logs

Why This Incident Matters

The breach demonstrates the risks associated with CI/CD infrastructure as a high-value attack target.

Build and automation platforms frequently have access to credentials that developers and applications need to deploy software. A compromised CI/CD system can therefore provide attackers with a path to:

CI/CD Server → Build Environment → Secrets → Cloud Accounts → Source Code → Production Infrastructure

This makes patch management for CI/CD infrastructure a critical part of an organization's broader security strategy.

The incident also highlights an important DevSecOps lesson: security controls must be applied consistently to internal infrastructure as well as customer-facing systems.

Lessons for Security Teams

Organizations operating TeamCity and other CI/CD platforms should consider the incident a reminder to:

• Maintain an accurate inventory of CI/CD infrastructure.
• Prioritize internet-facing build servers for vulnerability remediation.
• Monitor privileged CI/CD accounts.
• Store secrets in dedicated secrets-management platforms.
• Avoid embedding long-lived credentials in build environments.
• Use short-lived cloud credentials where possible.
• Apply least-privilege IAM policies.
• Monitor CI/CD-to-cloud activity.
• Maintain detailed audit logs.
• Regularly test credential-revocation procedures.
• Treat CI/CD systems as critical infrastructure.

Bottom Line

The JetBrains Cadence breach illustrates how a single unpatched vulnerability in a development platform can become a gateway to sensitive cloud infrastructure and development resources.

Attackers exploited CVE-2026-63077 to compromise the Cadence environment, gaining access to a 2024 server backup, AWS IAM credentials, S3 data and potentially source code synchronized from PyCharm projects.

For Cadence users, the immediate priority is credential rotation and threat hunting. For organizations operating TeamCity or similar CI/CD infrastructure, the incident reinforces the need to treat build systems as critical security assets rather than ordinary developer tooling.