JetBrains Cadence Breached via TeamCity Flaw, AWS Credentials Exposed

JetBrains has confirmed that attackers breached its Cadence cloud computing environment last month by exploiting a critical, recently patched vulnerability in TeamCity, gaining access to AWS credentials, user data, and a full server backup dating from 2024. Cadence is a JetBrains-hosted service that integrates with PyCharm to let developers run machine learning and heavy workloads on remote GPUs directly from the IDE. The company is now urging all Cadence users to immediately revoke and rotate any credentials or secrets that may have been used to run Cadence executions, and to treat all inputs and outputs within their projects as potentially untrusted. Users worried about exposure of their accounts can verify their email addresses against known incidents using an email breach checker and audit any reused passwords with a password checker.

The intrusion leveraged CVE-2026-63077, a deserialization of untrusted data vulnerability in TeamCity that carries a CVSS score of 9.8. The flaw allows an unauthenticated attacker with network access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands under the privileges of the TeamCity server process. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 5, 2026, and JetBrains detected the exploitation of its own environment on August 23, 2026. In subsequent updates, the company disclosed that the threat actor accessed the 2024 Cadence server backup and reached storage containing data tied to current users, including email addresses, project source code, and embedded credentials.

JetBrains confirmed that the accessed data set includes personal information such as usernames, real names, email addresses, last-login timestamps, and last-accessed IP addresses, alongside multiple AWS IAM users and associated secrets used with Cadence, including IAM users belonging to JetBrains employees who used the service. Files stored in S3 buckets within JetBrains AWS accounts tied to Cadence were also within reach of the attacker. "These findings did not identify any additional affected users. As a precaution, we are treating the data stored there as potentially exposed," said Daniel Gallo, Solutions Engineering Lead at JetBrains. Organizations handling cloud-resident secrets should also validate their perimeter posture and confirm that no anomalous external traffic is reaching internal endpoints by running a port scanner against exposed infrastructure.

The incident underscores how a single unpatched build-server vulnerability can cascade into a cloud-wide credential compromise, with the attacker converting a TeamCity authentication bypass into direct access to production AWS accounts and long-term backups. JetBrains has begun notifying affected users directly and recommends a full credential rotation across any system that interacted with Cadence. Security teams should treat any secrets, tokens, or API keys that touched the breached environment as fully compromised, audit CloudTrail logs for suspicious IAM activity, and verify that no unauthorized principals retain access to affected S3 buckets.