Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
JetBrains Cadence was breached via exploitation of CVE-2026-63077, a critical unpatched deserialization vulnerability (CVSS 9.8) in TeamCity, allowing unauthenticated remote code execution Threat actors accessed a 2024 server backup containing AWS IAM credentials, personal user data, source code, and S3 bucket contents, with the attack window spanning August 8–24, 2026 JetBrains confirmed the compromised server should have been patched but did not disclose why the vulnerability response failed,
Analysis
TL;DR
- JetBrains Cadence was breached via exploitation of CVE-2026-63077, a critical unpatched deserialization vulnerability (CVSS 9.8) in TeamCity, allowing unauthenticated remote code execution
- Threat actors accessed a 2024 server backup containing AWS IAM credentials, personal user data, source code, and S3 bucket contents, with the attack window spanning August 8–24, 2026
- JetBrains confirmed the compromised server should have been patched but did not disclose why the vulnerability response failed, and has since taken the server offline and invalidated all access tokens
- Users are urged to immediately rotate all credentials, audit connected cloud systems and repositories, and treat all prior Cadence executions and their inputs/outputs as potentially untrusted
Why It Matters
This incident highlights the cascading risk of supply chain and infrastructure vulnerabilities, where a single unpatched flaw in a development tool (TeamCity) can compromise an entire cloud computing service (Cadence) and expose sensitive user data including source code and cloud credentials. It serves as a stark reminder for AI practitioners and developers relying on integrated cloud IDE workflows to rigorously manage credential rotation, patch management, and backup security hygiene.
Technical Details
- Vulnerability exploited: CVE-2026-63077, a deserialization-of-untrusted-data flaw in JetBrains TeamCity (CVSS 9.8) that allows unauthenticated attackers to bypass authentication and execute arbitrary OS commands with the privileges of the TeamCity server process
- CISA KEV catalog: The vulnerability was added to CISA's Known Exploited Vulnerabilities list on August 5, 2026, indicating active exploitation in the wild before JetBrains discovered the intrusion on August 23, 2026
- Compromised data: A full 2024 server backup was exfiltrated, containing AWS IAM user credentials (including those of JetBrains employees), personal data (usernames, real names, emails, last-login timestamps, IP addresses), S3 bucket files, and potentially synchronized PyCharm project source code
- Indicators of compromise: Six IP addresses were identified (150.109.230.104, 43.153.227.206, 62.210.127.48, 210.247.242.190, 15.235.225.205, 152.233.30.18), along with suspicious authentication activity, unexpected repository changes, new service accounts, and modified cloud IAM policies
- Mitigation actions taken: The compromised server (api.cadence.jetbrains.com) was taken offline, all Cadence plugin access tokens in PyCharm were invalidated, and JetBrains is treating all data in the affected storage as potentially exposed
Industry Insight
- Patch management gaps are critical failure points: JetBrains admitted the vulnerable server should have been patched as part of its own vulnerability response, underscoring that even security-conscious organizations can have procedural failures in applying critical patches—organizations must audit their own patch management workflows rigorously
- Backup data is a high-value attack target: The exfiltration of a 2024 backup demonstrates that stale backups containing credentials and sensitive data remain a significant risk; organizations should implement backup encryption, access logging, and regular credential rotation to limit blast radius
- Integrated IDE-cloud workflows amplify exposure: The Cadence-PyCharm integration means source code and credentials synchronized from local projects may have been exposed; developers using similar cloud-connected IDE workflows should assume all synchronized data is compromised and conduct thorough audits of their repositories and connected cloud services
Disclaimer: The above content is generated by AI and is for reference only.