Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
JetBrains warns Cadence users to revoke and rotate all credentials after attackers exploited a critical vulnerability in TeamCity to breach its environment and extract AWS credentials.
Intelligence analysis by Qwen 2.5 (3B)
JetBrains has warned users of its Cadence service to revoke and rotate all credentials after attackers exploited a critical vulnerability in TeamCity to breach the environment and extract AWS credentials.
Some bad guys found a way to break into a computer system that runs a service called Cadence. They used a secret code to get into the system and took some important information, like email addresses and passwords. Now they tell people to change their secret codes and be extra careful with their information.
Analysis
The Exploited Vulnerability
CVE-2026-63077, with a CVSS score of 9.8, is a deserialization of untrusted data vulnerability that allows an unauthenticated attacker with access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. This flaw was discovered by JetBrains on August 23, 2026, and was actively exploited in the wild by attackers.
The Breach Details
The attackers gained access to the Cadence server and accessed data contained in the Cadence server backup from 2024, including email addresses, project source code, and credentials. They also obtained unauthorized access to data associated with current Cadence users. The breach affected the same group of users previously contacted by JetBrains.
The Impact and Recommendations
Users are being asked to rotate all credentials and review connected systems for suspicious activity. JetBrains has invalidated all access tokens used by the JetBrains Cadence plugin in PyCharm to connect to Cadence. Users are also advised to audit source code repositories for any unauthorized changes during the time period and treat all executions as potentially untrusted.
Key points
- JetBrains warned Cadence users to revoke and rotate all credentials after a breach
- The breach was caused by a deserialization of untrusted data vulnerability in TeamCity
- The attackers accessed data from a backup and current Cadence users' data
- Users are advised to review connected systems for suspicious activity and treat all executions as potentially untrusted
This incident highlights the importance of keeping software and systems up to date to prevent security vulnerabilities from being exploited. It also emphasizes the importance of rotating and reviewing credentials to ensure security.
The breach could lead to unauthorized access to personal data and increase the risk of phishing and other malicious activities. Users are advised to be extra cautious and review their systems for suspicious activity.
