JetBrains Cadence: TeamCity CVE-2026-63077 missed; customer data and secrets exposed
JetBrains' Cadence incident post (opened 28 August 2026, last updated 1 September 2026 12:05 CEST) confirms unauthorized access to Cadence, a JetBrains-hosted cloud-compute service for PyCharm via an optional plugin that orchestrates work with TeamCity. The Cadence host api.cadence.jetbrains.com was vulnerable to CVE-2026-63077 (desk card cve-2026-63077) and was exploited; activity from 8 August to 24 August 2026; discovered 23 August; server taken offline 24 August. Confirmed: personal data extracted (usernames, real names, emails, last-login times, last IPs); a full 2024 Cadence server backup compromised (treat credentials/config/artifacts in that backup as exposed); multiple AWS IAM users/secrets used with Cadence compromised from that backup; files in JetBrains Cadence S3 buckets accessed; possible access to source synchronized from PyCharm. JetBrains says no evidence secrets were taken from the live environment beyond the backup path, invalidated Cadence plugin access tokens, and lists IoC IPs (150.109.230.104, 43.153.227.206, 62.210.127.48, 210.247.242.190, 15.235.225.205, 152.233.30.18). Users must rotate all credentials used in Cadence executions and treat inputs/outputs as untrusted. Distinct from the On-Premises TeamCity ACSC exploitation card: this is JetBrains' own hosted Cadence service.
- Product
- JetBrains Cadence (PyCharm cloud plugin / TeamCity-backed)
- Versions
- api.cadence.jetbrains.com exploited 8–24 Aug 2026 via unpatched CVE-2026-63077
- Exploited in Australia?
- unknown
- Patch to
- Cadence taken offline; rotate all Cadence-linked secrets; review AWS/SCM/registry activity from 8 Aug 2026
Primary: JetBrains Cadence incident post · Vendor: JetBrains (vendor) · CVE: CVE-2026-63077 · JetBrains TeamCity CVE-2026-63077 advisory