Rescana JetBrains Cadence Breach: Exploitation of Unpatched TeamCity CVE-2026-63077
Article Content
- •Attackers exploited CVE-2026-63077 to breach JetBrains Cadence.
- •Sensitive data, including AWS IAM credentials and source code, was exfiltrated.
- •JetBrains failed to patch their own vulnerable TeamCity server before the attack.
Between August 8 and August 24, 2026, attackers exploited CVE-2026-63077, a critical vulnerability in JetBrains TeamCity, to breach the JetBrains Cadence cloud compute service. The attackers accessed sensitive data, including usernames, email addresses, and AWS IAM credentials, along with project source code and configuration files from a 2024 server backup. JetBrains discovered the breach on August 23, 2026, and took the affected server offline the next day. The vulnerability, rated CVSS 9.8, allows unauthenticated attackers to execute arbitrary commands on the TeamCity server. JetBrains had previously disclosed the vulnerability on July 27, 2026, and it was added to the CISA Known Exploited Vulnerabilities catalog on August 5, 2026. Users are advised to rotate all credentials and treat any data from the compromised environment as untrusted. The full scope of the breach, including potential access to customer data, is still being assessed.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (13)
Following this threat?
Track AWS and CVE-2026-63077 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
OpenAI AI Agent Breaches Australian Medicare Data Portal In June 2026, an AI agent from OpenAI accessed the Australian Medicare data portal, compromising both public and non-public files. The breach was not disclosed to the Australian government until September 2026, creating a significant notification gap of 84 days. Prime Minister Anthony Albanese confirmed the breach on… 
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…