CVE-2026-63077 — a deserialization flaw scored 9.8 — was the vector that allowed unknown attackers to breach JetBrains’ Cadence environment and extract AWS credentials, backups and user data, the company disclosed after discovering the exploitation on August 23, 2026.
The vulnerability and the intrusion window
JetBrains says the incident began when threat actors exploited CVE-2026-63077, a critical deserialization-of-untrusted-data vulnerability in TeamCity that can permit an unauthenticated attacker with access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on August 5, 2026. According to JetBrains, the intrusion into the affected Cadence environment occurred between August 8 and August 24, 2026.
What JetBrains says was taken or exposed
JetBrains reported that the threat actor accessed data contained in a Cadence server backup from 2024 and obtained unauthorized access that could have reached storage with data associated with current Cadence users. The company listed items it has “confirmed” the attacker accessed or compromised:
- Personal data: usernames, real names, email addresses, last-login timestamps, and last accessed IP addresses
- A full backup of the Cadence server dating from 2024, which contains credentials, configuration, artifacts, logs, or other data
- Multiple AWS IAM users and associated credentials/secrets used with Cadence, extracted from the 2024 backup, including IAM users belonging to JetBrains employees who used the service
- Files stored in S3 buckets within JetBrains AWS accounts used by Cadence
JetBrains also cautioned that attackers may have accessed source code synchronized from PyCharm projects to the affected server — covering cases where users relied on PyCharm to upload or synchronize project files for execution in Cadence.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleActions JetBrains has taken and is asking users to take
The exploited Cadence server, identified as "api.cadence.jetbrains.com," has been taken offline. JetBrains has invalidated all access tokens used by the JetBrains Cadence plugin in PyCharm to connect to Cadence. The company is urging Cadence users to revoke and rotate all credentials and secrets that may have been used to run their Cadence executions, and to treat all executions — including inputs and outputs — as potentially untrusted.
Specifically, JetBrains asks users to review connected systems for suspicious activity, with attention to AWS accounts, S3 buckets, deployment environments, package and container registries, and any other systems accessible with the revoked credentials. The company also recommends auditing source code repositories for unauthorized changes made during the intrusion window.
Indicators of compromise and observed activity
JetBrains published a set of indicators of compromise and red flags for affected users. They include:
- Activity occurring from August 8, 2026, onwards, particularly authentication or activity using credentials previously stored in or accessible through Cadence
- Authentication or other activity from unexpected IP addresses or locations; JetBrains listed observed IP addresses associated with exploitation activity: 150.109.230.104, 43.153.227.206, 62.210.127.48, 210.247.242.190, 15.235.225.205, and 152.233.30.18
- Unexpected repository clones or downloads, unexpected commits, changes to repository secrets, webhooks, collaborators, or permissions
- New or modified personal access tokens, API tokens, SSH keys, or new service accounts in external services
- Unexpected changes to cloud IAM roles, policies or permissions, and unexpected access to cloud storage such as S3 buckets and objects
- Unexpected publication or modification of packages or releases
What this means for technologists, enterprises and developers
Technologists and security teams: Rotate any credentials that were stored in Cadence, and audit cloud IAM roles, S3 access logs and deployment environments for activity from the August 8–24 window. JetBrains’ own invalidation of plugin tokens and taking "api.cadence.jetbrains.com" offline are immediate containment steps; teams must verify that additional service accounts and tokens were not created or misused.
Affected enterprises and procurement leaders: Treat source code and configuration synchronized via PyCharm to Cadence as potentially exposed; audit repositories for unexpected commits, changes to secrets, and modified collaborator permissions. Consider whether backups or archived artifacts were included in the 2024 server backup the company says was accessed.
Developers and end users of PyCharm/Cadence: Revoke personal and project-level credentials that may have been uploaded to or used by Cadence, watch for targeted phishing or impersonation using names and email addresses confirmed as accessed, and follow JetBrains’ guidance to treat executions as untrusted.
Unanswered operational details and next steps
JetBrains said it “conceded that the server in question should have been patched as part of its own vulnerability response efforts,” but did not provide details explaining why the patching did not occur. The company also said it has not identified any additional affected users beyond those already contacted directly; Daniel Gallo, Solutions Engineering Lead at JetBrains, stated, “This affects the same group of users we previously contacted directly. These findings did not identify any additional affected users. As a precaution, we are treating the data stored there as potentially exposed.”
The company warned of likely consequences from the personal data exposure, including “an increased risk of targeted phishing, social engineering, impersonation, and other unsolicited or malicious communications using the affected names and email addresses.” JetBrains’ published indicators and mitigation steps are the actionable record for organizations and individuals tied to Cadence while questions about the breach’s origin and the post-exploitation use of extracted AWS credentials remain to be answered.
