Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
Unknown attackers exploited critical TeamCity flaw CVE-2026-63077 to breach JetBrains Cadence, stealing a 2024 backup, user data, and AWS credentials; rotation urged.
JetBrains disclosed that threat actors exploited CVE-2026-63077 (CVSS 9.8), a TeamCity deserialization vulnerability added to CISA's KEV catalog on August 5, 2026, to breach its Cadence cloud computing service, with the intrusion running August 8-24, 2026. Confirmed access includes personal data (usernames, names, emails, login timestamps, IPs), a full 2024 Cadence server backup containing credentials and configuration, multiple AWS IAM users and secrets, files in JetBrains S3 buckets, and possibly PyCharm-synchronized source code. The compromised api.cadence.jetbrains.com server has been taken offline and all Cadence plugin access tokens invalidated. JetBrains urges users to immediately revoke or rotate all credentials used with Cadence and treat all executions, inputs, and outputs as potentially untrusted.
- Attackers exploited CVE-2026-63077 (CVSS 9.8), a TeamCity unauthenticated deserialization flaw on CISA's KEV catalog since August 5.
- Intrusion spanned August 8-24, 2026; attackers accessed a 2024 backup, user data, and AWS IAM credentials and secrets.
- JetBrains instructs users to revoke or rotate all Cadence credentials and treat all executions and their inputs/outputs as untrusted.
- Compromised api.cadence.jetbrains.com taken offline; PyCharm Cadence plugin access tokens invalidated; six attacker IPs shared as IOCs.
- CVEs
- CVE-2026-63077
- Vendors
- JetBrains
- Products
- JetBrains CadenceTeamCityPyCharm
- Victims
- JetBrains
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-63077 | Unauthenticated Deserialization RCE in JetBrains TeamCity On-Premises | 9.8 | 94% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 150.109.230.104 | P addresses associated with observed exploitation activity: 150.109.230.104 43.153.227.206 62.210.127.48 210.247.242.190 15.235.225.205 |
| ipv4 | 152.233.30.18 | 43.153.227.206 62.210.127.48 210.247.242.190 15.235.225.205 152.233.30.18 Authentication or other activity from unexpected IP address |
| ipv4 | 15.235.225.205 | 50.109.230.104 43.153.227.206 62.210.127.48 210.247.242.190 15.235.225.205 152.233.30.18 Authentication or other activity from unexpec |
| ipv4 | 210.247.242.190 | tion activity: 150.109.230.104 43.153.227.206 62.210.127.48 210.247.242.190 15.235.225.205 152.233.30.18 Authentication or other activi |
| ipv4 | 43.153.227.206 | ciated with observed exploitation activity: 150.109.230.104 43.153.227.206 62.210.127.48 210.247.242.190 15.235.225.205 152.233.30.18 |
| ipv4 | 62.210.127.48 | erved exploitation activity: 150.109.230.104 43.153.227.206 62.210.127.48 210.247.242.190 15.235.225.205 152.233.30.18 Authentication |
From the original article
3 min read at thehackernews.com
JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions," JetBrains said.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.