JetBrains Says Attackers Exploited Unpatched TeamCity Vulnerability to Breach Cadence Server
Summary
JetBrains says attackers exploited an unpatched vulnerability in a TeamCity installation on its Cadence server, accessing user data, a 2024 backup, and employee AWS credentials. The company is investigating and advises users to revoke and replace credentials sent viaCad
Key points
- JetBrains reported malicious activity on its Cadence server from August 8 through August 24, 2026.
- Attackers exploited CVE-2026-63077 in a TeamCity installation hosted on api.cadence.jetbrains.com.
- The company said attackers accessed personal user information, exfiltrated a 2024 Cadence backup, and obtained employee AWS IAM credentials.
- JetBrains is investigating whether additional secrets passing through Cadence were exposed, including repository, package registry, cloud, and signing credentials.
- JetBrains said the server should have received the patch for CVE-2026-63077 but remained unpatched.
- Users who sent credentials or tokens through Cadence should treat them as compromised and revoke and replace them.
Article Details
- Victim Organization
- JetBrains
- Victim Domain
- api.cadence.jetbrains.com
- Incident Type
- Exploitation of CVE-2026-63077 in a TeamCity installation, resulting in unauthorized access and data exfiltration.
- Data Types Exposed
- Personal user information
- 2024 Cadence backup archive
- AWS IAM credentials
- Potentially project source code, cloud credentials, authentication tokens, repository access keys, container registry secrets, SSH keys, and cryptographic signing keys
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed; the article reports exfiltration of a comprehensive 2024 Cadence backup archive.
- Operational Impact
- The Cadence server was compromised. The article says attackers had access to the infrastructure from August 8 through August 24, 2026, and that JetBrains was investigating which user secrets were acquired. Project owners were advised to revoke and replace credentials transmitted through Cadence.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
CVE
Vendors
Products
CadenceJetBrains Cadence Server CompromisedPyCharmCadence integrates deeply with PyCharm, enabling developers to execute projects efficiently across robust cloud computing resources.TeamCityThe malicious actors successfully exploited a critical vulnerability, designated CVE-2026-63077, residing within the TeamCity installation hosted on the `api.cadence.jetbrains.com` server.