actively-exploited-vulnerabilitygovernment-vulnerability-catalogbreach-disclosure-notificationthird-party-vendor-breach

JetBrains Cadence Breach Exposes AWS Credentials Through Exploited TeamCity RCE

Active Exploitation · 5 sources · Updated 2mo ago · First seen Sep 5, 2026

JetBrains disclosed that unidentified attackers breached its Cadence cloud-service environment by exploiting CVE-2026-63077, a critical unauthenticated remote-code-execution flaw in TeamCity On-Premises. The intrusion, detected after activity from August 8 through August 24, potentially exposed a 2024 Cadence server backup and data reachable from the affected server, including Cadence user personal data, PyCharm-synchronized project source code, AWS IAM credentials, configuration, artifacts, logs, and files in Cadence-associated S3 buckets.

CVE-2026-63077 is an insecure-deserialization vulnerability in TeamCity server-to-build-agent communications that can execute commands under the TeamCity server process account. CISA has listed it as actively exploited and JetBrains fixed it in TeamCity On-Premises versions 2025.11.7 and 2026.1.3. JetBrains took the affected Cadence API server offline and invalidated Cadence plugin tokens; affected customers should rotate credentials, investigate connected systems, and treat Cadence executions and associated inputs and outputs as untrusted.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · Aug 2026 – Aug 23, 2026

Reported Sep 5, 20262mo ago
JetBrains takes compromised Cadence API server offline
JetBrains took api.cadence.jetbrains.com offline and invalidated all Cadence plugin access tokens. It directed affected users to rotate credentials, investigate connected systems, and treat Cadence executions and their inputs and outputs as untrusted.
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Reported Sep 5, 20262mo ago
JetBrains confirms Cadence data and AWS credential exposure
JetBrains determined that attackers accessed or compromised multiple Cadence-related AWS IAM users and credentials, as well as files in Cadence-related S3 buckets. Potentially exposed data included Cadence user details, PyCharm-synchronized source code, configuration, artifacts, logs, and credentials.
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Aug 23, 20262mo ago
JetBrains discovers exploitation of its Cadence environment
JetBrains discovered the exploitation affecting its Cadence environment. The investigation found that the attackers had accessed a full Cadence server backup from 2024 and could potentially access storage containing current user data.
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Aug 8, 20263mo ago
Attackers compromise JetBrains Cadence through unpatched TeamCity
Unidentified attackers exploited CVE-2026-63077 to compromise JetBrains' Cadence cloud-service environment between August 8 and 24. The affected Cadence API server had not been patched during JetBrains' vulnerability-response process.
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Reported Aug 6, 20263mo ago
JetBrains releases TeamCity fixes for CVE-2026-63077
JetBrains released fixes for the critical insecure-deserialization flaw in TeamCity On-Premises in versions 2025.11.7 and 2026.1.3, and provided a security plugin as a temporary mitigation for organizations unable to upgrade.
CISA upozorava na kritičnu TeamCity ranjivost koja se aktivno zloupotrebljava - CERT RS
Aug 5, 20263mo ago
CISA adds actively exploited TeamCity flaw to KEV catalog
CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog after identifying active exploitation. The flaw enables unauthenticated remote command execution on vulnerable TeamCity On-Premises servers.
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Aug 2026
JetBrains reports possible access to customer S3 buckets
JetBrains reported that attackers accessed customer buckets through S3 buckets in its AWS environment after compromising Cadence-related credentials. The extent of customer-bucket access was not known.
Attackers Exploit TeamCity Flaw to Breach JetBrains Cadence - CySecurity News - Latest Information Security and Hacking Incidents

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

1 linked

Unauthenticated RCE in JetBrains TeamCity Agent Polling Protocol (CVE-2026-63077)

Affected products

2 linked

TeamcityTeamcity On-Premises

Organizations

1 linked

Jetbrains

Breaches

1 linked

JETBRAINS-2026-08

Observables

6 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

Cysecurity NewsNews · Sep 8, 2026

Attackers Exploit TeamCity Flaw to Breach JetBrains Cadence - CySecurity News - Latest Information Security and Hacking IncidentsOpen source ↗

BlueteamsecNews · Sep 7, 2026

Security Incident Affecting JetBrains Cadence - The JetBrains Blog - Infosec.PubOpen source ↗

The Hacker NewsNews · Sep 5, 2026

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS CredentialsOpen source ↗

Wiz Cloud ThreatsNews · Sep 1, 2026

JetBrains Cadence Compromised via Exploitation of TeamCity VulnerabilityOpen source ↗

Cert Rs AiktAdvisories · Aug 6, 2026

CISA upozorava na kritičnu TeamCity ranjivost koja se aktivno zloupotrebljava - CERT RSOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

actively-exploited-vulnerabilitygovernment-vulnerability-catalogbreach-disclosure-notificationthird-party-vendor-breach

JetBrains Cadence Breach Exposes AWS Credentials Through Exploited TeamCity RCE

Active Exploitation · 5 sources · Updated 2mo ago · First seen Sep 5, 2026

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · Aug 2026 – Aug 23, 2026

Reported Sep 5, 20262mo ago
JetBrains takes compromised Cadence API server offline
JetBrains took api.cadence.jetbrains.com offline and invalidated all Cadence plugin access tokens. It directed affected users to rotate credentials, investigate connected systems, and treat Cadence executions and their inputs and outputs as untrusted.
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Reported Sep 5, 20262mo ago
JetBrains confirms Cadence data and AWS credential exposure
JetBrains determined that attackers accessed or compromised multiple Cadence-related AWS IAM users and credentials, as well as files in Cadence-related S3 buckets. Potentially exposed data included Cadence user details, PyCharm-synchronized source code, configuration, artifacts, logs, and credentials.
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Aug 23, 20262mo ago
JetBrains discovers exploitation of its Cadence environment
JetBrains discovered the exploitation affecting its Cadence environment. The investigation found that the attackers had accessed a full Cadence server backup from 2024 and could potentially access storage containing current user data.
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Aug 8, 20263mo ago
Attackers compromise JetBrains Cadence through unpatched TeamCity
Unidentified attackers exploited CVE-2026-63077 to compromise JetBrains' Cadence cloud-service environment between August 8 and 24. The affected Cadence API server had not been patched during JetBrains' vulnerability-response process.
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Reported Aug 6, 20263mo ago
JetBrains releases TeamCity fixes for CVE-2026-63077
JetBrains released fixes for the critical insecure-deserialization flaw in TeamCity On-Premises in versions 2025.11.7 and 2026.1.3, and provided a security plugin as a temporary mitigation for organizations unable to upgrade.
CISA upozorava na kritičnu TeamCity ranjivost koja se aktivno zloupotrebljava - CERT RS
Aug 5, 20263mo ago
CISA adds actively exploited TeamCity flaw to KEV catalog
CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog after identifying active exploitation. The flaw enables unauthenticated remote command execution on vulnerable TeamCity On-Premises servers.
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Aug 2026
JetBrains reports possible access to customer S3 buckets
JetBrains reported that attackers accessed customer buckets through S3 buckets in its AWS environment after compromising Cadence-related credentials. The extent of customer-bucket access was not known.
Attackers Exploit TeamCity Flaw to Breach JetBrains Cadence - CySecurity News - Latest Information Security and Hacking Incidents

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →