Attackers Breached Jet Brains Cadence via Unpatched Team City, Extracting AWS Credentials
Summary: JetBrains reported that unidentified attackers exploited CVE-2026-63077, a deserialization flaw in TeamCity rated CVSS 9.8, to breach its Cadence cloud service between August 8 and 24, 2026, with JetBrains discovering the activity on August 23. The attackers reached a Cadence server backup from 2024 and storage holding current user data including email addresses, project source code, and credentials, and JetBrains has taken api.cadence.jetbrains.com offline and invalidated all Cadence plugin access tokens in PyCharm.
Key Takeaway: JetBrains states the affected server should have been patched under its own vulnerability response, and CISA had already added this flaw to its KEV catalog on August 5, 2026 - eighteen days before JetBrains found the intrusion. Every credential, secret, and synchronized PyCharm project tied to Cadence executions now has to be treated as compromised, including AWS accounts, S3 buckets, and registries reachable with those keys.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-63077
- Related
- CVE-2026-63077: Jet Brains Team City Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Aug 05, 2026