- JetBrains urges Cadence users to immediately revoke and rotate all credentials after attackers exploited a critical TeamCity vulnerability (CVE-2026-63077) to breach its environment.
- The intrusion between August 8 and 24, 2026, exposed personal data, credentials, AWS IAM secrets, source code, and a full 2024 server backup.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 5, 2026, as active exploitation emerged in the wild.
JetBrains is warning Cadence users to revoke and rotate all credentials after unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own cloud computing environment last month. The attack, leveraging CVE-2026-63077 (CVSS 9.8), allowed an unauthenticated attacker to bypass authentication checks and execute arbitrary OS commands on the affected server.
The Cadence service, a JetBrains-hosted cloud platform that integrates with PyCharm for running ML workloads on cloud GPUs, was compromised between August 8 and 24, 2026. JetBrains stated that the threat actor accessed a full backup of the Cadence server from 2024, which contained credentials, configuration data, and artifacts.
Consequently, attackers extracted multiple AWS IAM users and associated credentials from that backup, including IAM users belonging to JetBrains employees who used the service. JetBrains also confirmed the threat actor accessed files stored in S3 buckets within the company’s AWS accounts used by Cadence.
The company said that users should treat all executions, including their inputs and outputs, as potentially untrusted. Personal data exposed includes usernames, real names, email addresses, last-login timestamps, and last accessed IP addresses.
JetBrains has invalidated all access tokens used by the Cadence plugin in PyCharm and taken the exploited server offline. The company conceded the server should have been patched as part of its own vulnerability response efforts, but did not share details on why this did not occur.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
