Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

JetBrains disclosed a significant security incident affecting its Cadence cloud development service, revealing that attackers exploited a critical vulnerability in the company's own TeamCity continuous integration platform—a platform that JetBrains had already patched publicly, but failed to apply to its internal infrastructure. The breach, discovered on August 23, 2026, exposed AWS credentials, personal user data, a complete 2024 server backup, and potentially sensitive development artifacts spanning from August 8 through August 24. The incident represents a painful irony: a company that manufactures developer tools and security software was compromised through unpatched infrastructure of its own making.

The Vulnerability: CVE-2026-63077

The flaw at the center of the breach is CVE-2026-63077, a critical remote code execution vulnerability in TeamCity On-Premises with a CVSS score of 9.8 (maximum severity). The vulnerability exists in TeamCity's agent polling protocol, allowing unauthenticated attackers with HTTP or HTTPS access to bypass authentication checks entirely. More specifically, the flaw involves deserialization of untrusted data in the agent polling protocol. An attacker who can reach a TeamCity server can exploit this vulnerability to execute arbitrary operating system commands with the privileges of the TeamCity server process—typically high-level system permissions in CI/CD environments. JetBrains disclosed CVE-2026-63077 on July 27, 2026. Security researchers immediately recognized the severity. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on August 5, 2026, confirming that the flaw was already under active exploitation in the wild.

The Irony: JetBrains Patched Everywhere But Here

What makes this incident particularly damaging to JetBrains' credibility is that the company published patches for CVE-2026-63077 across all product versions and environments—everywhere, apparently, except the internal TeamCity server running api.cadence.jetbrains.com. The Cadence server, which sits at the core of JetBrains' cloud development service, relied on TeamCity to orchestrate workloads. TeamCity is not a peripheral component—it's a critical piece of infrastructure orchestrating development tasks for an entire cloud service. Yet this infrastructure-critical TeamCity installation remained unpatched despite the company's own security team publishing patches three weeks before attackers exploited it. This represents a catastrophic failure of internal patch management. JetBrains, a company whose entire business depends on developer trust, failed to apply critical security patches to its own systems—a failure that directly contradicted its public advice to customers.

The Attack: Entry, Persistence, Discovery

Attackers exploited CVE-2026-63077 on August 8, 2026, gaining access to the Cadence infrastructure. The attack went undetected for 16 days until JetBrains discovered the compromise on August 23, 2026. By that point, attackers had already extracted sensitive data and established access to Cadence's backend systems. On August 24, 2026, JetBrains took the affected server offline while continuing investigation.

What the Attackers Stole

The scope of the breach is substantial: A complete Cadence server backup from 2024, containing everything stored in that backup: credentials, configuration files, artifacts, logs, and potentially source code. Personal information belonging to Cadence users, though JetBrains has not disclosed how many individuals were affected. Multiple AWS IAM user accounts and their associated credentials. These credentials belong to AWS accounts used by JetBrains to run the Cadence service, as well as personal AWS accounts belonging to JetBrains employees who used Cadence. Access to S3 buckets within JetBrains' AWS accounts associated with the service. JetBrains is still investigating whether attackers accessed customer storage buckets, but has confirmed access to internal S3 infrastructure. Given the nature of CI/CD and cloud development infrastructure, the compromised systems likely also exposed access to source code repositories, Git tokens, package registry credentials, SSH keys, and code signing keys—all of which could grant attackers the ability to compromise software supply chains or infrastructure. Why This Matters: Developer Infrastructure Compromise Breaching a web application is serious. Breaching developer infrastructure is catastrophic. A CI/CD system and cloud development environment like Cadence sits at the center of software development workflow. The credentials and secrets stored in such systems grant access to core organizational infrastructure: source code repositories, deployment systems, package registries, cloud services, and code signing infrastructure. A single compromised AWS credential might grant complete access to cloud infrastructure, databases, backups, and customer data. A compromised Git token might allow attackers to modify source code across an entire organization's codebase. A compromised code signing key might enable attackers to distribute malicious software that appears legitimate. For developers using Cadence through the PyCharm plugin to run machine learning or compute-intensive workloads on cloud GPUs, the compromise is even more direct: attackers potentially accessed credentials and secrets that developers used to run Cadence executions.

What Comes Next

JetBrains says it has found no evidence that data or secrets were extracted from the current Cadence environment—only from the 2024 backup and exposed through the unpatched server. However, the company's investigation is ongoing, and the full scope of what was accessed or compromised may not be fully clear for weeks or months. For Cadence users, the incident forces immediate credential rotation, auditing, and remediation work. For organizations that depend on Cadence for development workflows, the trust question lingers: can JetBrains be trusted to secure the infrastructure that developers depend on? For the broader developer community, the incident is a reminder that even companies with security expertise can fail at basic operational security when patch management discipline lapses. It underscores the critical importance of asset inventories, change management procedures, and automation in patch deployment. The fact that JetBrains published patches for CVE-2026-63077 publicly, yet failed to apply them internally, makes this a particularly painful lesson. It's the equivalent of a security software vendor publishing a patch for a critical vulnerability affecting its own antivirus product, then running an unpatched version of that antivirus on its own systems. For JetBrains, the incident will likely result in increased scrutiny of its internal security practices, customer demand for transparency about security investments, and potential long-term damage to the company's brand in the developer community.