--- schema: 1 kind: incident title: > JetBrains admits its own Cadence cloud-compute service ran unpatched against a KEV-listed vulnerability it had disclosed a month earlier, and was breached through it for sixteen days headline: > JetBrains: our Cadence service should have been patched against our own CVE-2026-63077 advisory — it wasn't, and attackers used it for 16 days summary: > JetBrains disclosed (last updated 2026-09-03) that its Cadence cloud-compute service — reachable via an optional PyCharm plugin — was compromised through CVE-2026-63077, the unauthenticated TeamCity remote-code-execution flaw JetBrains itself disclosed in July 2026 and which CISA added to its Known Exploited Vulnerabilities catalog on 2026-08-05. JetBrains admits the Cadence server was never patched against its own advisory. Exploitation ran 2026-08-08 to 2026-08-24; confirmed impact includes personal data, a compromised 2024 server backup, multiple AWS IAM users' credentials, S3 bucket access, and possible exposure of synced PyCharm project source code. Affected users must rotate every credential that ever touched a Cadence execution. discovered_at: "2026-09-06T04:45:00Z" updated_at: null event_date: "2026-09-03" run_id: 2026-09-06T0409Z-intel priority: high immediate_action: null tags: [data-breach, rce, pre-auth, cisa-kev, supply-chain] regions: [global] sectors: [technology] entities: ["incident:jetbrains-cadence-teamcity-breach-2026-08"] techniques: [T1190, T1552, T1530, T1078.004] affected_products: ["JetBrains TeamCity On-Premises", "JetBrains Cadence"] cves: - id: CVE-2026-63077 cvss: "9.8" epss: null type: deserialization vector: zero-click auth: pre-auth status: [exploited, cisa-kev, patch-available] affected: "All TeamCity On-Premises versions prior to the branch fixes (see the original disclosure entry); the Cadence server ran an unpatched, internet-facing TeamCity instance" fixed: "2025.11.7 and 2026.1.3 for TeamCity On-Premises; JetBrains states its own Cadence server should have been patched as part of its response to the vulnerability but was not" sources: - url: "https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/" publisher: "JetBrains (PyCharm Blog)" date: "2026-09-03" role: primary - url: "https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html" publisher: "The Hacker News" date: "2026-09-05" role: corroborating - url: "https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/" publisher: "JetBrains (TeamCity PSIRT)" date: "2026-07-27" role: corroborating closed_sources: [] evidence: - quote: "We have since confirmed the Cadence environment was vulnerable to CVE-2026-63077 and was exploited through this vulnerability." publisher: "JetBrains (PyCharm Blog)" source_url: "https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/" - quote: "The server should have been patched as part of our response to the vulnerability, but it was not. We sincerely apologize for this failure and the impact it may have on you." publisher: "JetBrains (PyCharm Blog)" source_url: "https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/" - quote: "Compromised multiple AWS IAM users and associated credentials/secrets used with Cadence, including IAM users belonging to JetBrains employees who used the service." publisher: "JetBrains (PyCharm Blog)" source_url: "https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/" - quote: "We have confirmed that the threat actor accessed data contained in the Cadence server backup from 2024." publisher: "JetBrains (PyCharm Blog)" source_url: "https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/" verification: multi-source sourcing_note: > CVSS 9.8 and the 2026-08-05 KEV-addition date are cited to The Hacker News's reporting; both figures were independently cross-checked against the CVE's own MITRE record and the CISA KEV catalog feed and confirmed accurate, but neither is cited directly as pipeline policy excludes NVD/MITRE per-CVE pages and the CISA KEV catalog root as citable sources (derived data sheets / listing pages, not disclosing primaries). confidence: high references: ["2026-07-29/cve-2026-63077-teamcity-onprem-unauth-deserialization-rce"] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Any organization that used JetBrains Cadence must revoke and rotate every credential and secret ever used in a Cadence execution — cloud (AWS/Azure/GCP), source-control, package-registry, container-registry, Slack, SSH/deployment keys and signing material — and review connected AWS accounts, S3 buckets and source repositories for unauthorized access or changes during 2026-08-08 to 2026-08-24." - "Anyone who synchronized PyCharm project files to Cadence for execution must treat that source code, and any credentials or configuration it contains, as compromised and audit repositories for unauthorized changes made during the affected period." updates: - at: "2026-09-06T14:05:00Z" run_id: 2026-09-06T1308Z-audit type: improvement internal: true summary: > Credibility lowered from 1 to 2. The incident narrative rests on JetBrains's own disclosure, with the corroborating outlet relaying that disclosure rather than assessing the incident independently, which is the definition of an uncorroborated claim from a reliable source. fields: [classification] migrated_from: null --- JetBrains disclosed, in an incident notice last updated 2026-09-03, that its Cadence cloud-compute service — a JetBrains-hosted offering integrated with PyCharm through an optional plugin, letting developers run projects on JetBrains-managed cloud compute — was compromised via CVE-2026-63077 ([JetBrains, 2026-09-03](https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/)). That CVE is a deserialization flaw in JetBrains TeamCity, which Cadence used internally to orchestrate workloads, letting an unauthenticated attacker execute arbitrary operating-system commands with TeamCity server-process privileges; The Hacker News's coverage of the KEV listing puts it at CVSS 9.8 ([The Hacker News, 2026-09-05](https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html)). JetBrains itself disclosed CVE-2026-63077 in July 2026 ([JetBrains TeamCity PSIRT, 2026-07-27](https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/)), and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-05 after observing active exploitation elsewhere ([The Hacker News, 2026-09-05](https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html)). Despite owning that advisory, JetBrains admits the Cadence server — `api.cadence.jetbrains.com` — was never patched against it: "the server should have been patched as part of our response to the vulnerability, but it was not" ([JetBrains, 2026-09-03](https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/)). Exploitation activity ran from 2026-08-08 to 2026-08-24; JetBrains discovered it on 2026-08-23 and took the server offline the next day. Confirmed impact spans several categories. Threat actors accessed and extracted personal data for the affected user cohort: usernames, real names, email addresses, last-login timestamps and last-accessed IP addresses. They compromised a full 2024 backup of the Cadence server, meaning any credentials, configuration, artifacts or logs present in that backup must be treated as potentially exposed. They compromised multiple AWS IAM users and their associated credentials, including IAM users belonging to JetBrains employees who used the service, extracted from that same 2024 backup ([JetBrains, 2026-09-03](https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/)). They accessed files stored in S3 buckets within JetBrains's own AWS accounts used by Cadence, with the full scope still under investigation; JetBrains states it does not currently know whether customer-account storage buckets were reached, though some users had configured Cadence to access their own buckets, exposing those connection credentials too. Finally, source code synchronized from PyCharm projects to the affected server may have been accessed, and JetBrains instructs anyone who used that sync path to treat the code, and any embedded credentials or configuration, as potentially compromised. JetBrains has invalidated all Cadence plugin access tokens and is notifying relevant authorities. The root-cause lesson generalizes past this one vendor: a vendor's own KEV-listed, self-disclosed CVE went unpatched on its own production infrastructure for the better part of a month after publication. Patch-SLA enforcement has to apply to internally- or vendor-hosted CI/CD infrastructure with the same urgency as the advisory a vendor ships to its customers — the exposure here was JetBrains's own build orchestration server, not a customer's. Detection concept, telemetry class first: on any self-hosted TeamCity instance (Cadence's own root cause), web-server or reverse-proxy access logs showing requests to the agent-polling endpoint from addresses outside the registered build-agent fleet are the first signal, and process-creation telemetry showing the TeamCity server process spawning a shell, interpreter or network utility outside a build step is the second, more decisive one — see the original CVE-2026-63077 entry's Detection section for the full discriminator. For any organization that used Cadence specifically: cloud audit-log review for authentication or IAM/role-policy changes from unexpected addresses since 2026-08-08, unexpected S3 object access in JetBrains-adjacent or connected AWS accounts, and unexpected commits, new personal-access-tokens or new service accounts appearing in source-control and package-registry systems that ever received a credential through a Cadence execution. **Defender takeaway:** treat any Cadence usage during the affected window as a full credential-compromise event, not a data-exposure notice — revoke and rotate first, investigate second, because JetBrains's own guidance is that the inventory of exposed credentials it can offer affected users is not exhaustive.