Loading story…
JetBrains disclosed that unidentified attackers breached its Cadence cloud-service environment by exploiting CVE-2026-63077, a critical unauthenticated remote-code-execution flaw in TeamCity On-Premises. The intrusion, detected after activity from August 8 through August 24, potentially exposed a 2024 Cadence server backup and data reachable from the affected server, including Cadence user personal data, PyCharm-synchronized project source code, AWS IAM credentials, configuration, artifacts, logs, and files in Cadence-associated S3 buckets.
CVE-2026-63077 is an insecure-deserialization vulnerability in TeamCity server-to-build-agent communications that can execute commands under the TeamCity server process account. CISA has listed it as actively exploited and JetBrains fixed it in TeamCity On-Premises versions 2025.11.7 and 2026.1.3. JetBrains took the affected Cadence API server offline and invalidated Cadence plugin tokens; affected customers should rotate credentials, investigate connected systems, and treat Cadence executions and associated inputs and outputs as untrusted.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
JetBrains discovered the exploitation affecting its Cadence environment. The investigation found that the attackers had accessed a full Cadence server backup from 2024 and could potentially access storage containing current user data.
Unidentified attackers exploited CVE-2026-63077 to compromise JetBrains' Cadence cloud-service environment between August 8 and 24. The affected Cadence API server had not been patched during JetBrains' vulnerability-response process.
CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog after identifying active exploitation. The flaw enables unauthenticated remote command execution on vulnerable TeamCity On-Premises servers.
JetBrains reported that attackers accessed customer buckets through S3 buckets in its AWS environment after compromising Cadence-related credentials. The extent of customer-bucket access was not known.
JetBrains took api.cadence.jetbrains.com offline and invalidated all Cadence plugin access tokens. It directed affected users to rotate credentials, investigate connected systems, and treat Cadence executions and their inputs and outputs as untrusted.
JetBrains determined that attackers accessed or compromised multiple Cadence-related AWS IAM users and credentials, as well as files in Cadence-related S3 buckets. Potentially exposed data included Cadence user details, PyCharm-synchronized source code, configuration, artifacts, logs, and credentials.
JetBrains released fixes for the critical insecure-deserialization flaw in TeamCity On-Premises in versions 2025.11.7 and 2026.1.3, and provided a security plugin as a temporary mitigation for organizations unable to upgrade.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourceinfosec.pub
Open sourcethehackernews.com
Open sourcethreats.wiz.io
Open sourcecert.aikt.rs
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited **CVE-2026-63077**, a critical (CVSS 9.8) authentication-bypass and arbitrary-command-execution flaw affecting all JetBrains TeamCity On-Premises versions, to compromise an unpatched TeamCity server supporting JetBrains’ Cadence cloud development service. Activity at `api.cadence.jetbrains.com` ran from August 8 to August 24 and may have exposed a 2024 server backup, user data, source code, credentials, configurations, build artifacts, and logs. JetBrains confirmed compromise of several AWS IAM users and access to files in its AWS S3 buckets, while it continued investigating whether customer storage buckets were accessed. Australian authorities and CISA had already warned of active exploitation and urged organizations to identify exposed TeamCity instances, apply JetBrains updates or its security patch plugin, and remove TeamCity interfaces from direct internet exposure where possible. Public exploit support has also advanced through Metasploit module `exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077`, including improved payload selection for Java/JSP, Windows, and Linux targets. Cadence users should rotate every credential and secret handled by the service, investigate connected environments for unauthorized activity and lateral movement, and treat executions and outputs generated during the exposure period as untrusted.
Aug 28, 2026
JetBrains has patched a high-severity vulnerability in TeamCity On-Premises, tracked as **`CVE-2026-44413`**, that can allow privilege escalation and expose parts of the TeamCity server API to unauthorized users. The company said affected deployments include TeamCity On-Premises **2025.11.4 and earlier**, and advised customers to upgrade to **TeamCity 2026.1** or apply the available security patch plugin. According to JetBrains, the flaw could expose sensitive data including API tokens, Git credentials, build secrets, logs, and user information, with higher risk in environments that permit inbound connections on non-standard ports or run build agents on the same host as the TeamCity server. The issue requires access to a TeamCity account, which attackers could obtain through brute force, credential stuffing, leaked credentials, social engineering, or enabled guest access, raising the prospect of follow-on compromise of cloud infrastructure, source code repositories, and software delivery pipelines. The disclosure comes against a backdrop of repeated TeamCity security incidents, including **`CVE-2024-27198`** and **`CVE-2024-27199`**, two critical flaws that allowed unauthenticated attackers to bypass authentication, take over servers, alter certificates and ports, and create supply-chain attack paths; those earlier bugs were fixed in **2023.11.4** after researchers warned they could lead to full server compromise.
Jun 29, 2026
JetBrains disclosed **CVE-2026-63077**, a critical remote code execution flaw in TeamCity On-Premises that lets unauthenticated attackers with HTTP(S) access abuse the agent polling protocol to bypass authentication and run arbitrary operating system commands. The vulnerability affects TeamCity versions before **2026.1.3** and **2025.11.7**, carries a CVSS 3.1 rating of **9.8** (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`), and is mapped to **CWE-502**. JetBrains released fixes in **2025.11.7** and **2026.1.3**, and also published a security patch plugin for TeamCity versions **2017.1 and later** for organizations that cannot upgrade immediately. TeamCity Cloud instances were already updated, while JetBrains said it has **no evidence of active exploitation**; CISA’s SSVC assessment likewise indicates no known exploitation but notes the bug is **automatable** and could have **total technical impact**. Successful attacks could expose TeamCity data, configurations, and stored credentials, or allow modification of server state depending on the privileges of the TeamCity process.
Aug 25, 2026