JetBrains Confirms Cadence Cloud Breach: TeamCity Zero-Day CVE-2026-63077 Used Against Own Infrastructure
On 23 August JetBrains found its Cadence cloud environment compromised. Attackers used the unauthenticated TeamCity RCE CVE-2026-63077 (CVSS 9.8), stole AWS credentials, and reached S3 holding user data and source.
Incident Overview
Disclosure in early September: on 23 August JetBrains found an unknown actor had compromised its Cadence cloud environment via the critical TeamCity bug CVE-2026-63077 (CVSS 9.8). Cadence is JetBrains-hosted GPU cloud for ML and heavy compute launched from PyCharm. CVE-2026-63077 is unauthenticated RCE via deserialization of untrusted data in the agent polling protocol. CISA added it to KEV on 5 August.
The vendor that disclosed the bug is also a victim—the chain shows CI/CD and R&D infra vulns hit vendors and customers the same way.
Impact
Attacker accessed 2024 Cadence server backups containing credentials and config, extracted multiple AWS IAM users and keys, reached S3 buckets holding user data, and may have obtained source synced from PyCharm projects. JetBrains says the affected set matches users it already contacted; no additional affected users found.
Cadence users should treat historical run records, stored secrets, email addresses, source, and job I/O as potentially leaked.
Remediation
- Orgs still on unpatched TeamCity (before 2026.1.3 / 2025.11.7) must upgrade now. Exploited in the wild; conditions are clear.
- Cadence users: rotate every credential and key used for Cadence jobs or stored in the service, especially AWS IAM.
- Treat historical job inputs, outputs, and project data as untrusted. Review pipelines for poisoned deps or scripts.
- Do not expose CI/CD build servers to the Internet. Put them on the internal network, VPN/whitelist access, and centralize audit logs.
This incident restates the point: TeamCity, Jenkins, GitLab CI and similar toolchain pieces are high-value targets. One successful hit spreads along credentials and code into the whole supply chain.
References
- CyberRecaps: Daily Cybersecurity News — September 6, 2026 (JetBrains Cadence incident roundup)