Attackers Exploited TeamCity Vulnerability to Breach JetBrains Cadence
Summary
JetBrains says attackers exploited CVE-2026-63077 in TeamCity to breach Cadence. Data and credentials were accessed or may have been exposed; JetBrains took the server offline, invalidated plugin tokens and urged users to rotate credentials.
Key points
- JetBrains says unidentified attackers exploited CVE-2026-63077, a critical TeamCity vulnerability, to access its Cadence environment between August 8 and 24, 2026.
- The accessed data included personal information, a 2024 server backup, AWS IAM credentials and files in JetBrains S3 buckets.
- JetBrains said the intrusion could also have exposed current users’ email addresses, project source code and credentials; PyCharm-synced project contents may have been accessible.
- JetBrains took the affected Cadence server offline and invalidated access tokens used by the Cadence PyCharm plugin.
- The company urged Cadence users to revoke or rotate credentials and secrets, treat executions and their inputs and outputs as untrusted, and check connected systems and repositories for suspicious activity.
- JetBrains warned that exposed personal information could increase the risk of targeted phishing, social engineering and impersonation.
Article Details
- Victim Organization
- JetBrains
- Victim Domain
- api.cadence.jetbrains.com
- Incident Type
- Unauthorized access to JetBrains' Cadence environment following exploitation of CVE-2026-63077 in TeamCity.
- Data Types Exposed
- Personal data, including usernames, real names, email addresses, last-login timestamps, and last accessed IP addresses
- Credentials and secrets
- Cadence server backup data, including configuration, artifacts, and logs
- AWS IAM credentials and secrets
- Files stored in S3 buckets
- Potentially, source code and project files synchronized from PyCharm
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- The affected Cadence server was taken offline, and JetBrains invalidated access tokens used by the Cadence plugin in PyCharm. Users were instructed to rotate credentials and review connected systems for suspicious activity.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 15[.]235[.]225[.]205 | IP address associated by JetBrains with observed exploitation activity. |
| IPV4 | 150[.]109[.]230[.]104 | IP address associated by JetBrains with observed exploitation activity. |
| IPV4 | 152[.]233[.]30[.]18 | IP address associated by JetBrains with observed exploitation activity. |
| IPV4 | 210[.]247[.]242[.]190 | IP address associated by JetBrains with observed exploitation activity. |
| IPV4 | 43[.]153[.]227[.]206 | IP address associated by JetBrains with observed exploitation activity. |
| IPV4 | 62[.]210[.]127[.]48 | IP address associated by JetBrains with observed exploitation activity. |
CVE
People
Vendors
Products
CadenceJetBrains is warning Cadence users to revoke and rotate all credentials after attackers exploited CVE-2026-63077 in TeamCity to breach its environment and potentially access backups, source code, and secrets.JetBrains TeamCityJetBrains is warning Cadence users to revoke and rotate all credentials after attackers exploited CVE-2026-63077 in TeamCity to breach its environment and potentially access backups, source code, and secrets.PyCharmThe incident may have exposed personal data, AWS IAM credentials, S3 files, and PyCharm-synced project contents, prompting urgent review of connected systems and suspicious activity.