actively-exploited-vulnerabilitybuild-pipeline-compromiseweaponized-exploit-availabilityinternet-facing-service-vulnerability

TeamCity RCE Exploitation Breaches JetBrains Cadence Service

Active Exploitation · 3 sources · Updated 2mo ago · First seen Aug 25, 2026

Attackers exploited CVE-2026-63077, a critical (CVSS 9.8) authentication-bypass and arbitrary-command-execution flaw affecting all JetBrains TeamCity On-Premises versions, to compromise an unpatched TeamCity server supporting JetBrains’ Cadence cloud development service. Activity at api.cadence.jetbrains.com ran from August 8 to August 24 and may have exposed a 2024 server backup, user data, source code, credentials, configurations, build artifacts, and logs. JetBrains confirmed compromise of several AWS IAM users and access to files in its AWS S3 buckets, while it continued investigating whether customer storage buckets were accessed.

Australian authorities and CISA had already warned of active exploitation and urged organizations to identify exposed TeamCity instances, apply JetBrains updates or its security patch plugin, and remove TeamCity interfaces from direct internet exposure where possible. Public exploit support has also advanced through Metasploit module exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077, including improved payload selection for Java/JSP, Windows, and Linux targets. Cadence users should rotate every credential and secret handled by the service, investigate connected environments for unauthorized activity and lateral movement, and treat executions and outputs generated during the exposure period as untrusted.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

12 events · 2023 – Aug 27, 2026

Reported Aug 28, 20262mo ago
JetBrains directs Cadence users to rotate credentials and investigate
JetBrains advised Cadence users to rotate secrets and credentials used or stored in Cadence, treat affected-period executions as untrusted, and investigate connected source-control, cloud, and package environments for misuse or lateral movement.
JetBrains told everyone to patch. It didn't patch itself. - The New Stack
Reported Aug 28, 20262mo ago
JetBrains confirms Cadence data and credential exposure risks
JetBrains confirmed compromise of several AWS IAM users and associated credentials, while still determining whether customer storage buckets were accessed. It said Cadence user data, source code, credentials, configuration, artifacts, logs, and execution outputs may have been exposed or affected.
JetBrains told everyone to patch. It didn't patch itself. - The New Stack
Aug 27, 20262mo ago
Metasploit TeamCity exploit-module enhancement moves to Todo
GitHub automation added an enhancement for Metasploit's CVE-2026-63077 TeamCity RCE module to the project Kanban Todo board. The proposed changes improve target-specific payload selection and prefer HTTP-based payload fetching.
Always select best payload and add Java to list of preferred by jheysel-r7 · Pull Request #21838 · rapid7/metasploit-framework · GitHub
Reported Aug 25, 20262mo ago
Australian authorities warn of active TeamCity exploitation
The Australian Cyber Security Centre warned that threat actors were actively exploiting CVE-2026-63077 and that Australian organizations operating TeamCity On-Premises were at risk. It urged organizations to identify exposed instances, apply updates or the patch plugin, and reconsider internet exposure of TeamCity interfaces.
Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity Magazine
Aug 24, 20262mo ago
JetBrains takes compromised Cadence server offline
JetBrains took the affected Cadence TeamCity server offline, ending the assessed August 8–24 affected period. Attackers had obtained a complete 2024 server backup and accessed files in JetBrains AWS S3 buckets used by Cadence.
JetBrains told everyone to patch. It didn't patch itself. - The New Stack
Aug 23, 20262mo ago
JetBrains discovers Cadence TeamCity compromise
JetBrains discovered that attackers had exploited its unpatched Cadence TeamCity server. The company acknowledged the server should have been patched for CVE-2026-63077.
JetBrains told everyone to patch. It didn't patch itself. - The New Stack
Aug 8, 20263mo ago
Attackers begin activity on JetBrains Cadence TeamCity server
JetBrains assessed that malicious activity began on August 8 against an unpatched TeamCity server behind api.cadence.jetbrains.com, which orchestrated Cadence cloud-compute workloads.
JetBrains told everyone to patch. It didn't patch itself. - The New Stack
Aug 7, 20263mo ago
JetBrains reports exploitation of unpatched TeamCity servers
JetBrains issued a follow-up advisory reporting active and attempted exploitation targeting unpatched TeamCity servers, and instructed customers to update to TeamCity 2025.11.7 or 2026.1.3 or install the security patch plugin immediately.
Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity Magazine
Aug 5, 20263mo ago
CISA adds CVE-2026-63077 to the KEV Catalog
CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, warning that such flaws present significant risks to the federal enterprise.
Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity Magazine
Jul 27, 20263mo ago
JetBrains discloses critical TeamCity authentication-bypass RCE flaw
JetBrains disclosed CVE-2026-63077, a CVSS 9.8 flaw affecting all TeamCity On-Premises versions that lets unauthenticated HTTP(S) attackers bypass authentication and execute operating-system commands. JetBrains released patches during July and directed users to update or use its security patch plugin.
Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity Magazine
2024
Attackers extensively exploit two TeamCity vulnerabilities
Two vulnerabilities affecting TeamCity On-Premises were reported as extensively exploited in 2024, including one that allowed remote unauthenticated attackers to completely compromise a server.
Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity Magazine
2023
Nation-state actors target a critical TeamCity flaw
A critical TeamCity vulnerability disclosed in 2023 was targeted by Russian and North Korean nation-state actors.
Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity Magazine

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

1 linked

Unauthenticated RCE in JetBrains TeamCity Agent Polling Protocol (CVE-2026-63077)

Affected products

2 linked

TeamcityTeamcity On-Premises

Organizations

1 linked

Jetbrains

Breaches

1 linked

JETBRAINS-2026-08

Observables

6 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

ThenewstackNews · Aug 28, 2026

JetBrains told everyone to patch. It didn't patch itself. - The New StackOpen source ↗

Metasploit Pull RequestsNews · Aug 27, 2026

Always select best payload and add Java to list of preferred by jheysel-r7 · Pull Request #21838 · rapid7/metasploit-framework · GitHubOpen source ↗

Infosecurity Magazine NewsNews · Aug 25, 2026

Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity MagazineOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

actively-exploited-vulnerabilitybuild-pipeline-compromiseweaponized-exploit-availabilityinternet-facing-service-vulnerability

TeamCity RCE Exploitation Breaches JetBrains Cadence Service

Active Exploitation · 3 sources · Updated 2mo ago · First seen Aug 25, 2026

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

12 events · 2023 – Aug 27, 2026

Reported Aug 28, 20262mo ago
JetBrains directs Cadence users to rotate credentials and investigate
JetBrains advised Cadence users to rotate secrets and credentials used or stored in Cadence, treat affected-period executions as untrusted, and investigate connected source-control, cloud, and package environments for misuse or lateral movement.
JetBrains told everyone to patch. It didn't patch itself. - The New Stack
Reported Aug 28, 20262mo ago
JetBrains confirms Cadence data and credential exposure risks
JetBrains confirmed compromise of several AWS IAM users and associated credentials, while still determining whether customer storage buckets were accessed. It said Cadence user data, source code, credentials, configuration, artifacts, logs, and execution outputs may have been exposed or affected.
JetBrains told everyone to patch. It didn't patch itself. - The New Stack
Aug 27, 20262mo ago
Metasploit TeamCity exploit-module enhancement moves to Todo
GitHub automation added an enhancement for Metasploit's CVE-2026-63077 TeamCity RCE module to the project Kanban Todo board. The proposed changes improve target-specific payload selection and prefer HTTP-based payload fetching.
Always select best payload and add Java to list of preferred by jheysel-r7 · Pull Request #21838 · rapid7/metasploit-framework · GitHub
Reported Aug 25, 20262mo ago
Australian authorities warn of active TeamCity exploitation
The Australian Cyber Security Centre warned that threat actors were actively exploiting CVE-2026-63077 and that Australian organizations operating TeamCity On-Premises were at risk. It urged organizations to identify exposed instances, apply updates or the patch plugin, and reconsider internet exposure of TeamCity interfaces.
Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity Magazine
Aug 24, 20262mo ago
JetBrains takes compromised Cadence server offline
JetBrains took the affected Cadence TeamCity server offline, ending the assessed August 8–24 affected period. Attackers had obtained a complete 2024 server backup and accessed files in JetBrains AWS S3 buckets used by Cadence.
JetBrains told everyone to patch. It didn't patch itself. - The New Stack
Aug 23, 20262mo ago
JetBrains discovers Cadence TeamCity compromise
JetBrains discovered that attackers had exploited its unpatched Cadence TeamCity server. The company acknowledged the server should have been patched for CVE-2026-63077.
JetBrains told everyone to patch. It didn't patch itself. - The New Stack
Aug 8, 20263mo ago
Attackers begin activity on JetBrains Cadence TeamCity server
JetBrains assessed that malicious activity began on August 8 against an unpatched TeamCity server behind api.cadence.jetbrains.com, which orchestrated Cadence cloud-compute workloads.
JetBrains told everyone to patch. It didn't patch itself. - The New Stack
Aug 7, 20263mo ago
JetBrains reports exploitation of unpatched TeamCity servers
JetBrains issued a follow-up advisory reporting active and attempted exploitation targeting unpatched TeamCity servers, and instructed customers to update to TeamCity 2025.11.7 or 2026.1.3 or install the security patch plugin immediately.
Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity Magazine
Aug 5, 20263mo ago
CISA adds CVE-2026-63077 to the KEV Catalog
CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, warning that such flaws present significant risks to the federal enterprise.
Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity Magazine
Jul 27, 20263mo ago
JetBrains discloses critical TeamCity authentication-bypass RCE flaw
JetBrains disclosed CVE-2026-63077, a CVSS 9.8 flaw affecting all TeamCity On-Premises versions that lets unauthenticated HTTP(S) attackers bypass authentication and execute operating-system commands. JetBrains released patches during July and directed users to update or use its security patch plugin.
Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity Magazine
2024
Attackers extensively exploit two TeamCity vulnerabilities
Two vulnerabilities affecting TeamCity On-Premises were reported as extensively exploited in 2024, including one that allowed remote unauthenticated attackers to completely compromise a server.
Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity Magazine
2023
Nation-state actors target a critical TeamCity flaw
A critical TeamCity vulnerability disclosed in 2023 was targeted by Russian and North Korean nation-state actors.
Australia Warns of Active Exploitation of Critical TeamCity Server Fla - Infosecurity Magazine

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →