Summary
- Attackers exploited CVE-2026-63077 against JetBrains Cadence between 8 and 24 August.
- JetBrains confirmed personal-data theft, compromise of a 2024 server backup, AWS identities, and access to company-controlled S3 storage.
- JetBrains says the affected Cadence server should have been patched during its TeamCity response but was missed.
JetBrains has confirmed that attackers exploited a critical TeamCity vulnerability against its Cadence cloud-development service after an affected server was missed during the company’s own patching response.
The incident creates a potentially broad credential exposure around development infrastructure. JetBrains said attackers extracted personal information, compromised a full Cadence server backup dating from 2024, compromised multiple Amazon Web Services identity and access management users, and accessed files in S3 buckets within JetBrains AWS accounts used by the service.
Cadence is a JetBrains-hosted service integrated with PyCharm through an optional plugin, allowing developers to run projects on cloud computing resources. The service used TeamCity to orchestrate workloads, and the affected server was vulnerable to CVE-2026-63077.
The TeamCity flaw can be exploited without authentication by an attacker with HTTP or HTTPS access to a vulnerable server. Successful exploitation allows operating-system commands to run with the privileges of the TeamCity server process.
JetBrains identified malicious activity from 8 August, discovered the exploitation on 23 August, and took api.cadence.jetbrains.com offline on 24 August. Its investigation remains in progress.
The company has confirmed that attackers extracted usernames, real names, email addresses, last-login timestamps, and last-accessed IP addresses from the affected environment. It has not identified additional compromised resources or data in its latest update.
The older server backup creates a more complicated exposure. JetBrains said credentials, configuration, artefacts, logs, and other information contained in the 2024 copy must be considered potentially compromised. Multiple AWS IAM identities and credentials used with Cadence were present in the backup, including accounts belonging to JetBrains employees.
The company also confirmed access to files held in JetBrains-controlled S3 buckets used by Cadence. Whether attackers reached storage buckets belonging to customers remains unknown.
Development systems can carry credentials far beyond the platform on which they run. JetBrains has told Cadence users to consider secrets used with the service potentially compromised, including AWS, Azure, and Google Cloud credentials; GitHub, GitLab, and Bitbucket tokens; package-repository credentials; container-registry access; API tokens; SSH and deployment keys; service accounts; and signing material.
Source code synchronised from PyCharm projects to Cadence may also have been accessible. JetBrains has not said such source code was necessarily extracted, but has advised customers to treat code and any secrets contained within it as potentially exposed.
The incident follows the wider movement of CVE-2026-63077 into active exploitation. TeamCity attacks had already moved beyond theoretical exposure earlier in August, when JetBrains acknowledged successful and attempted exploitation against unpatched customer servers.
Fixes are available in TeamCity 2025.11.7 and 2026.1.3, while JetBrains provides a security patch plugin for older supported installations.
Cadence turns that vulnerability into an incident involving JetBrains’ own hosted infrastructure. The company said the affected server should have been patched as part of its response to CVE-2026-63077, but was not.
That acknowledgement places asset and patch governance alongside the underlying software flaw. Build and development environments often have extensive access to repositories, cloud accounts, package systems, deployment infrastructure, and signing credentials. A missed system in that part of an estate can therefore expose considerably more than the server itself.
Historical backups add another layer of risk because credentials captured when the backup was created may remain valid elsewhere long after the underlying system has changed. In this case, JetBrains has advised customers to rotate potentially exposed secrets rather than assume age alone renders them unusable.
JetBrains has invalidated access tokens used by the Cadence plugin, taken the affected server offline, contacted affected users, and notified relevant authorities. Its investigation is continuing, including work to establish the complete scope of the AWS access and whether customer-controlled storage was reached.
