Full Report
JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions," JetBrains said.
Analysis Summary
# Incident Report: JetBrains Cadence Environment Breach
## Executive Summary
JetBrains suffered a significant security breach in August 2026 involving its Cadence cloud computing service, caused by an unpatched critical vulnerability in TeamCity (CVE-2026-63077). Unidentified threat actors gained unauthorized access to internal servers, compromising a 2024 server backup, AWS IAM credentials, and user data. The incident has prompted an urgent global advisory for Cadence users to rotate all secrets and treat previous executions as untrusted.
## Incident Details
- **Discovery Date:** August 23, 2026
- **Incident Date:** August 8, 2026 – August 24, 2026
- **Affected Organization:** JetBrains (specifically the Cadence service)
- **Sector:** Software Development / Cloud Computing
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** August 8, 2026
- **Vector:** Exploitation of CVE-2026-63077
- **Details:** Attackers exploited a critical deserialization vulnerability in an unpatched TeamCity server, allowing for unauthenticated remote code execution (RCE).
### Lateral Movement
- **Details:** Using the initial foothold on the TeamCity/Cadence server, attackers accessed storage containing current user data and a legacy 2024 server backup. They further compromised AWS IAM credentials belonging to JetBrains employees and accessed internal S3 buckets.
### Data Exfiltration/Impact
- **Details:** The threat actors confirmedly accessed personal data (usernames, emails, IPs), a full 2024 backup containing logs and artifacts, multiple AWS IAM secrets, and files stored in JetBrains' internal S3 buckets. There is also a high likelihood that user source code synchronized via the PyCharm plugin was exposed.
### Detection & Response
- **Discovery:** Detected by JetBrains security teams on August 23, 2026.
- **Response actions taken:** The affected server (`api.cadence.jetbrains.com`) was taken offline; all access tokens for the Cadence PyCharm plugin were invalidated; and direct notifications were sent to affected users.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2026-63077 (RCE via Deserialization).
- **Persistence:** Unauthorized access maintained through compromised server environments.
- **Privilege Escalation:** Arbitrary OS command execution with TeamCity server process privileges.
- **Credential Access:** Extraction of AWS IAM credentials and secrets from 2024 server backups and active storage.
- **Discovery:** Reconnaissance of S3 buckets and Cadence user data storage.
- **Exfiltration:** Potential cloning/downloading of user repositories and S3 bucket files.
- **Impact:** Compromise of the integrity of the Cadence execution environment and exposure of sensitive development intellectual property.
## Impact Assessment
- **Financial:** Undisclosed, but involves significant remediation and credential rotation costs.
- **Data Breach:** High; includes PII, AWS credentials, server backups, and synchronized source code.
- **Operational:** The `api.cadence.jetbrains.com` service was taken offline, disrupting user workflows.
- **Reputational:** Significant; JetBrains admitted the breach resulted from a failure to patch its own high-profile vulnerability.
## Indicators of Compromise
- **Network indicators:**
- 150.109.230[.]104
- 43.153.227[.]206
- 62.210.127[.]48
- 210.247.242[.]190
- 15.235.225[.]205
- 152.233.30[.]18
- **Behavioral indicators:**
- Authentication events from unexpected geographic locations.
- Unexpected repository clones or downloads.
- Activity using AWS IAM credentials previously stored in the Cadence environment.
## Response Actions
- **Containment:** Decommissioned the vulnerable Cadence server.
- **Eradication:** Invalidated all PyCharm Cadence plugin access tokens.
- **Recovery:** Notified affected users and provided instructions for credential rotation.
## Lessons Learned
- **Patch Management:** Internal systems must be prioritized for critical patches, especially when the organization is the vendor of the vulnerable software.
- **Backup Security:** Legacy backups (from 2024) contained valid or sensitive secrets that remained useful to attackers years later.
- **Service Isolation:** Highly privileged IAM credentials should not be stored in environments accessible to web-facing RCE vulnerabilities.
## Recommendations
- **Rotate Credentials:** Immediately revoke and rotate all AWS keys, API tokens, and secrets used within the Cadence service.
- **Audit Executions:** Treat all outputs and inputs from Cadence executions prior to August 24, 2026, as potentially malicious.
- **Vulnerability Scanning:** Implement automated internal scanning to ensure all public-facing services are patched against CISA KEV (Known Exploited Vulnerabilities) catalog items within 24–48 hours.