JetBrains — Cadence Compromise via Outdated TeamCity Server and AWS Secret Extraction (CVE-2026-63077)

Publication date: September 5, 2026
Category: Data Breach / Identity Security

Introduction

JetBrains has issued an urgent advisory urging Cadence users to immediately revoke and rotate all credentials and secrets used in their execution pipelines. The directive follows a security incident last month in which unidentified threat actors successfully breached JetBrains’ internal environment by exploiting a recently disclosed critical vulnerability in TeamCity. The attack directly impacted the core Cadence production server (api.cadence.jetbrains.com), compromising personal data, historical server backups, and associated cloud credentials.

What is Cadence and the TeamCity Vulnerability? (General Analysis)

JetBrains Cadence is a cloud-hosted computing service integrated with PyCharm via an optional plugin, allowing developers to execute machine learning models and heavy workloads on cloud GPUs directly from their integrated development environment.

The entry vector leveraged by the attackers was CVE-2026-63077, an official vulnerability carrying a CVSS v3.1 score of 9.8 (CRITICAL) and mapped to CWE-502 (Deserialization of Untrusted Data).

Official NVD MetricConfirmed Detail
CVECVE-2026-63077
CVSS Score9.8 (CRITICAL)
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE ClassificationCWE-502: Deserialization of Untrusted Data
CISA KEVYes (Added on August 5, 2026)

This flaw enables an unauthenticated attacker with access to a vulnerable TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the underlying TeamCity server process.

How Does It Work? (Technical Analysis)

The exploitation workflow and subsequent lateral movement within the JetBrains Cadence infrastructure unfolded through distinct tactical phases:

  • Initial infection flow / Exploit entry: Threat actors took advantage of insufficient input validation within the agent polling protocol of TeamCity versions prior to 2026.1.3 and 2025.11.7. By injecting malicious serialized objects via unauthenticated network requests, they achieved remote code execution (RCE) on the Cadence server.
  • Persistence and access to historical data: Once system control was secured, the attackers accessed a complete backup of the Cadence server dating back to 2024. This backup contained configuration files, system logs, artifacts, and critical credentials and secrets belonging to users and JetBrains employees.
  • Exfiltration and cloud compromise: Armed with credentials harvested from the historical backup, the unauthorized actors gained access to multiple AWS IAM users and S3 storage buckets utilized by Cadence, alongside potential exposure of source code synchronized from PyCharm development projects.

Affected Systems / Environments

The security incident directly targeted infrastructure managed by JetBrains and impacted developers interacting with the Cadence ecosystem. Specific components involved include:

  • JetBrains TeamCity: Versions prior to 2026.1.3 and 2025.11.7.
  • JetBrains Cadence Service: Servers hosted under api.cadence.jetbrains.com (currently taken offline).
  • Development Environments: Users who relied on PyCharm and the Cadence plugin to upload or synchronize project workloads.

Mitigation and Detection

Remediation

  • Mass Secret Rotation: All Cadence users must immediately revoke and generate new credentials, personal access tokens, SSH keys, and API secrets that were previously stored or accessible via the service.
  • Server Patching: Apply official vendor security updates to all self-hosted TeamCity installations, upgrading to version 2026.1.3, 2025.11.7, or later.
  • Zero-Trust Treatment: Treat all prior executions, including their inputs and outputs within Cadence projects, as potentially untrusted and compromised.

Detection

Defensive teams and SOC analysts should audit connected environments for the following Indicators of Compromise (IoCs) and anomalous behavioral patterns:

  • Observed malicious IP addresses:
    • 150.109.230.104
    • 43.153.227.206
    • 62.210.127.48
    • 210.247.242.190
    • 15.235.225.205
    • 152.233.30.18
  • Cloud Log Monitoring: Review AWS CloudTrail audit logs for unexpected access to S3 buckets or unauthorized modifications to IAM roles and policies originating from Cadence-associated identities.
  • Repository Activity: Inspect for unauthorized commits, mass repository clones, or unexpected modifications to webhooks, collaborators, and repository permissions.

Threat Intelligence Note: The exposure of historical backups highlights how long-term data retained without strict lifecycle and encryption enforcement can act as a persistent critical vector, long after the original data was archived.

Wrapping Up

The security incident affecting JetBrains Cadence underscores the critical risks posed by unauthenticated remote code execution vulnerabilities in enterprise integration platforms like TeamCity. The exploitation of CVE-2026-63077 not only compromised operational service infrastructure but also exposed cloud credentials and legacy 2024 backups, proving that delayed vulnerability response can rapidly escalate into widespread identity and data breaches.

References