JetBrains Cadence Breached via Unpatched TeamCity RCE

JetBrains is telling Cadence users to revoke AWS credentials and change passwords after attackers used CVE-2026-63077, a CVSS 9.8 unauthenticated remote code execution flaw in TeamCity, to breach the Cadence platform’s backend infrastructure.

The intrusion ran from August 8 to August 23, 2026, when JetBrains discovered it. JetBrains disclosed CVE-2026-63077 on July 28 and shipped patches that same day: TeamCity 2025.11.7 (LTS) and 2026.1.3 (current). TeamCity Cloud was patched automatically. CISA added the flaw to the Known Exploited Vulnerabilities catalog on August 5 with a remediation deadline of August 8. The api.cadence.jetbrains.com server was still running the vulnerable version when the attack began.

JetBrains acknowledges the server “should have been patched as part of its own vulnerability response efforts.”

What was taken

JetBrains’ disclosure lists the following as confirmed stolen:

• Personal account data: usernames, real names, email addresses, login timestamps, and IP addresses for Cadence users
• A complete 2024 Cadence server backup, including stored credentials and configuration data
• AWS IAM credentials and secrets used by the Cadence service
• Files from JetBrains’ S3 buckets linked to the Cadence environment
• Source code from PyCharm projects synchronized through the Cadence platform

The 2024 server backup is the most consequential item. Backups tend to contain configuration data and credentials that were rotated out of active use but never scrubbed from the archive.

What to do

If you have a Cadence account, do this now:

1. Revoke every AWS IAM credential you linked to or stored in Cadence. Rotation is not sufficient here: rotate a key and the attacker’s copy of the old one still works. Revoke the old key entirely.
2. Change your Cadence password. If you reused it on other services, change it there too.
3. Check any PyCharm projects you synchronized through Cadence for hardcoded secrets or API tokens.

If you run TeamCity On-Premises anywhere in your environment, patch to 2025.11.7 or 2026.1.3 if you haven’t already. Rapid7 found the agent-listener protocol is an additional attack surface beyond the main RCE path. EPSS for CVE-2026-63077 is 0.865 and active exploitation is now confirmed in the wild.

The pattern

Developer tooling keeps ending up as the entry point. Langflow servers were exploited to pull OpenAI and AWS keys on September 2. JFrog Artifactory’s authentication bypass was used as a supply-chain pivot point a day earlier. Build servers, CI runners, and ML platforms share a common trait: they sit on a dense pile of credentials by design, and teams running them are usually optimizing for uptime rather than patch velocity.

JetBrains’ security advisories page has the CVE history. The site’s CVE-2026-63077 entry has current EPSS, CISA KEV dates, and the full version list.