Every credential used against Cadence, JetBrains’ cloud compute service for PyCharm developers, is now presumed burned. The company is telling users to revoke and rotate them all after attackers got into its own environment through an unpatched TeamCity vulnerability.
The entry point was CVE-2026-63077, a deserialization bug rated critical with a CVSS score of 9.8. On a TeamCity server, an unauthenticated attacker can exploit it to skip authentication and execute operating system commands with the server process’s privileges. CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 5.
The fallout extends well beyond JetBrains’ own systems. The intruders, active from August 8 to August 24, reached a 2024 backup of the Cadence server holding credentials, configuration, and artifacts, and extracted multiple AWS IAM users and associated secrets, including accounts belonging to JetBrains employees. Access may also have extended to S3 storage containing email addresses, project source code, and credentials tied to current Cadence users, plus source code synchronized from PyCharm projects.
JetBrains pulled the breached server, api.cadence.jetbrains.com, from service and killed every access token the PyCharm plugin used to reach Cadence. It has not explained why the server escaped the patching its own advisory process should have triggered. No additional affected users were identified beyond the group previously contacted directly, but JetBrains is treating all data stored there as potentially exposed.
Its guidance to users is blunt: treat all Cadence executions, including inputs and outputs, as potentially untrusted, and assume any credentials or secrets stored in the service, in the compromised backup, or made available to executions are compromised. Organizations running TeamCity should treat this as a reminder that patching obligations apply internally too.
