JetBrains has revealed a security incident involving its Cadence cloud development service after attackers gained access through an unpatched TeamCity server. The compromise exposed sensitive credentials, source code, and service information, causing concerns regarding the security of development environments connected to cloud computing resources.
During this incident, CVE-2026-63077, a critical TeamCity On-Premises vulnerability, was exploited by an unauthenticated attacker, allowing him to execute operating system commands on an affected server without any authentication.
A flaw disclosed by JetBrains on July 27 was exploited soon after by vulnerable TeamCity installations. In the case of Cadence, it was api.cadence.jetbrains.com, the infrastructure used to support JetBrains' cloud computing service for PyCharm, which was vulnerable.
A malicious attacker is believed to have begun attacking on August 8 JetBrains discovered the intrusion on August 23 and taken the affected server offline the following day, putting the confirmed incident window between August 8 and August 24. Cadence integrates with PyCharm through an optional plugin that provides access to cloud-based computing resources for development projects.
As TeamCity managed those workloads behind the service, the compromised system was part of a closely related environment involving software development and execution. JetBrains acknowledged that the server should have been patched immediately following the disclosure of the TeamCity vulnerability, but remained unpatched.
Following the discovery of the critical vulnerability in TeamCity, the company has previously advised organizations to update vulnerable TeamCity deployments.
In addition, the breach became more significant because attackers obtained a complete backup of Cadence server data from 2024. In addition, JetBrains confirmed that several Amazon Web Services IAM users and their credentials were compromised, including those belonging to Cadence employees.
The backup may contain credentials, configuration data, artifacts, and logs.
A compromised backup contained more than routine service data. It also contained configuration information and credentials associated with cloud and development resources. Researchers also discovered that JetBrains customers' own buckets were accessed through S3 buckets within JetBrains' Amazon Web Services environment.
The extent of customer access to these buckets is unknown.
There were several aspects of the development infrastructure exposed, including access to AWS IAM accounts, source-control access, package and container registry credentials, API tokens, SSH and deployment keys, service accounts and signing credentials, among others.
In the event of valid credentials remaining after the compromise, such access could provide a path into connected systems. JetBrains has not identified a specific threat actor as responsible for the activity, and no custom malware has been identified.
Instead of exploiting a TeamCity vulnerability, the attacker used legitimate credentials and cloud services to conduct the intrusion. This method can make it difficult to distinguish malicious activity from normal administrative activity. This incident demonstrates the security implications of continuous integration and continuous delivery.
Using TeamCity environments, you can access source repositories, build artifacts, deployment systems, package registries, and cloud resources. Thus, a compromise on this level can lead to credential theft, unauthorized changes, and software supply chain attacks beyond the affected server.
According to JetBrains, access tokens for the Cadence plugin in PyCharm have been invalidated, and users are encouraged to revoke or rotate credentials and secrets that were potentially used during Cadence executions.
In addition, Cadence inputs and outputs derived from this period should be viewed as potentially untrusted. As a result of the TeamCity vulnerability, a CVSS score of 9.8 has been assigned to it; it affects on-premises installations not updated to the latest version.
The JetBrains patch version 2025.11.7 and version 2026.1.3, along with a security patch plugin, are available for environments in which immediate upgrades are not possible.
After exploitation was observed in the wild, CISA added the flaw to its catalog of Known Exploited Vulnerabilities. JetBrains has begun to assess the impact of the Cadence breach and has prompted a broader review of the affected environment.
Upon completing the investigation, the company will contact affected users if further information is discovered that requires action.
According to the company, the incident is limited to the data associated with the Cadence host identified. It illustrates how critical it is to keep the CI/CD infrastructure patched, particularly when development systems are connected to the cloud and sensitive credentials.
