JetBrains Cadence breach exposed AWS credentials via TeamCity

JetBrains is telling users of its Cadence cloud service to revoke and rotate all credentials after a security incident in which attackers exploited a critical vulnerability in an unpatched TeamCity server to get into the company's own environment. The flaw, tracked as CVE-2026-63077, carries the highest severity rating of 9.8 on the CVSS scale, which measures how dangerous a vulnerability is, with 10 being the most severe. Cadence is a JetBrains-hosted cloud computing service that lets developers run machine learning and other heavy workloads on cloud graphics processing units directly from the PyCharm code editor through an optional plugin.

The vulnerability is a deserialization of untrusted data issue. In plain terms, it lets an attacker who can reach a TeamCity server bypass normal login checks and run operating system commands with the same privileges as the TeamCity server process. The United States Cybersecurity and Infrastructure Security Agency added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on August 5, 2026, meaning the bug is known to be actively exploited in real attacks. JetBrains says it discovered this specific exploitation on August 23, 2026. The intrusion happened between August 8 and August 24, 2026. The affected Cadence server, api.cadence.jetbrains.com, has since been taken offline. JetBrains also acknowledged that the server should have been patched as part of its own vulnerability response work, but the company did not explain why that did not happen.

According to JetBrains, the attacker reached a full backup of the Cadence server from 2024. That backup contained credentials, configuration, artifacts, logs, and other data. JetBrains also confirmed that the attacker accessed multiple AWS IAM users and associated credentials and secrets extracted from the backup, including IAM users belonging to JetBrains employees who used the service. AWS IAM is Amazon Web Services' Identity and Access Management system, which controls who can use cloud resources. The attacker also reached files stored in S3 buckets within JetBrains AWS accounts used by Cadence. S3 buckets are a common type of cloud storage container on Amazon Web Services. Personal data confirmed as accessed includes usernames, real names, email addresses, last-login timestamps, and last accessed IP addresses. JetBrains said the attacker may have also reached source code synchronized from PyCharm projects to the affected server, meaning code, credentials, or configurations uploaded or synchronized for execution in Cadence could have been exposed. Daniel Gallo, Solutions Engineering Lead at JetBrains, said the findings affect the same group of users previously contacted directly, and no additional affected users were identified, but the company is treating the stored data as potentially exposed.

JetBrains has invalidated all access tokens used by the Cadence plugin in PyCharm to connect to the service. The company also shared a list of indicators of compromise. These include activity from August 8, 2026 onwards that uses credentials previously stored in or accessible through Cadence, connections from specific IP addresses such as 150.109.230.104, 43.153.227.206, 62.210.127.48, 210.247.242.190, 15.235.225.205, and 152.233.30.18, authentication from unexpected locations, unexpected repository clones or downloads, changes to repository secrets or permissions, new or modified access tokens or SSH keys, new service accounts, unexpected changes to cloud IAM roles or policies, and unexpected access to cloud storage. JetBrains is asking users to not only rotate credentials but also review connected systems such as AWS accounts, S3 buckets, deployment environments, and package registries, audit source code repositories for unauthorized changes, and treat all Cadence executions as potentially untrusted. The company warns that the likely consequences of the personal data exposure include targeted phishing, social engineering, impersonation, and other unsolicited or malicious communications.

For website owners and IT teams, this incident is a reminder that a single unpatched server can expose not just one account but an entire cloud environment, including credentials that grant access to storage and source code. For teams that run cloud workloads and need to control who can access what, security-first IT and infrastructure consulting such as AEU-I can provide a practical second look at cloud identity settings and credential handling. JetBrains has not said who was behind the attack.