JetBrains Urges Credential Rotation After Cadence TeamCity Breach

JetBrains discloses Cadence intrusion

JetBrains has urged Cadence users to immediately revoke or rotate all credentials and secrets used to run Cadence executions after attackers exploited an unpatched TeamCity vulnerability to breach the service. The company said the intrusion affected Cadence environments and ran from August 8 to 24, 2026.

The exploited issue is CVE-2026-63077, a deserialization of untrusted data vulnerability in TeamCity with a CVSS score of 9.8. An unauthenticated attacker with access to a TeamCity server can bypass authentication checks and execute operating-system commands with the privileges of the TeamCity server process.

Cadence is a JetBrains-hosted cloud computing service that integrates with PyCharm through an optional plugin, allowing developers to run machine-learning and other demanding workloads on cloud GPUs directly from the IDE. JetBrains said the affected server, api.cadence.jetbrains.com, has been taken offline.

The company acknowledged that the server should have been patched through its vulnerability-response process, but did not explain why the update had not been applied. CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on August 5, 2026, and JetBrains detected the exploitation on August 23.

Backup, AWS credentials and project data at risk

JetBrains said the threat actor accessed a full Cadence server backup from 2024. That backup could contain credentials, configuration data, artifacts, logs and other information. The company also said the attacker obtained access that could have enabled access to storage associated with current Cadence users, including email addresses, project source code and credentials.

Confirmed or potentially compromised information includes usernames, real names, email addresses, last-login timestamps and last accessed IP addresses. JetBrains said multiple AWS IAM users and associated credentials or secrets used with Cadence were extracted from the backup, including IAM users belonging to employees who used the service.

The attackers also accessed files stored in S3 buckets in JetBrains AWS accounts used by Cadence. JetBrains cautioned that source code may have been exposed where PyCharm had uploaded or synchronized project files to the affected server for execution. Such files could include code, credentials or configuration data.

What affected organizations should review

JetBrains has invalidated all access tokens used by the Cadence plugin in PyCharm and said users should consider all Cadence executions, including their inputs and outputs, potentially untrusted. It also asked users to examine connected systems for suspicious activity after August 8, particularly activity involving credentials once stored in or accessible through Cadence.

• Rotate credentials and secrets used with Cadence.
• Review AWS accounts, S3 buckets, deployment environments and package or container registries.
• Audit repositories for unexpected clones, downloads, commits, changes to secrets, webhooks, collaborators and permissions.
• Investigate new or modified personal access tokens, API tokens, SSH keys, service accounts and cloud IAM policies.

JetBrains warned that exposed names and email addresses can raise the risk of targeted phishing, social engineering and impersonation. For businesses using Cadence, the practical implication is to complete credential rotation promptly and use the stated exposure period to investigate repository, cloud-storage and identity activity for unauthorized changes.