JetBrains is telling users of its Cadence cloud service to immediately revoke and rotate all credentials following a security breach last month in which unidentified hackers exploited a critical vulnerability to infiltrate the company's own systems. Cadence, a cloud computing platform that connects with PyCharm to let developers run machine learning and resource-intensive tasks on cloud GPUs, was compromised through CVE-2026-63077, a deserialization flaw in TeamCity with a severity score of 9.8. The attack allowed unauthenticated intruders with network access to bypass authentication controls and run arbitrary operating system commands with full TeamCity server privileges.
The breach ran from August 8 through August 24, 2026, when JetBrains discovered the intrusion on August 23. Attackers confirmed to have accessed personal information including usernames, real names, email addresses, last-login timestamps, and last accessed IP addresses for affected users. They also obtained a complete backup of the Cadence server from 2024 containing credentials, configuration files, artifacts, logs, and other stored information. Multiple AWS IAM users and their associated credentials—including those belonging to JetBrains employees who used the service—were extracted from the 2024 backup, along with files housed in S3 buckets within JetBrains AWS accounts linked to Cadence. The compromised server, api.cadence.jetbrains.com, has been shut down.
JetBrains warned that the intruders could have reached storage holding data tied to current Cadence users, including email addresses, project source code, and login credentials. "[Cadence users] should also treat all executions, including their inputs and outputs in your Cadence project, as potentially untrusted," the company stated. Solutions Engineering Lead Daniel Gallo noted that subsequent analysis "did not identify any additional affected users," but added that the company is "treating the data stored there as potentially exposed" as a precaution. The software maker also acknowledged the exploited server should have received patches as part of its vulnerability response process but offered no explanation for why that didn't occur.
The vulnerability at the heart of the attack has been actively exploited in the wild, prompting the U.S. Cybersecurity and Infrastructure Security Agency to add it to its Known Exploited Vulnerabilities catalog on August 5, 2026. Because attackers gained entry to the Cadence server itself, any credentials or secrets stored in Cadence, contained in the compromised backup, or made available to processes running on the affected infrastructure must be considered compromised and rotated. Source code may also have been accessed if users relied on PyCharm to upload or synchronize project files for execution in Cadence, potentially exposing code, credentials, or configuration details in the process.
JetBrains is instructing users to review connected systems—particularly AWS accounts, S3 buckets, deployment environments, package and container registries, and any other infrastructure accessible with the now-revoked credentials—for signs of suspicious activity. The company has invalidated all access tokens used by the JetBrains Cadence plugin in PyCharm to connect to the service and provided indicators of compromise including five IP addresses linked to the exploitation and a checklist of anomalies to watch for: unexpected authentication from unfamiliar locations, repository clones or downloads outside normal patterns, changes to repository secrets or webhooks, new or modified API tokens, new service accounts, unexpected alterations to cloud permissions, and unusual access to cloud storage. "The likely consequences of the personal data exposure include an increased risk of targeted phishing, social engineering, impersonation, and other unsolicited or malicious communications," JetBrains said, cautioning users to audit source code repositories for unauthorized changes during the breach window and treat all prior executions as potentially untrustworthy. The incident underscores how rapidly a single unpatched server can cascade into enterprise-wide credential exposure, forcing security teams to choose between operational continuity and the disruptive work of rotating every secret that might have been touched. For companies running hybrid development workflows that bridge local IDEs and cloud compute, the attack illustrates why isolation boundaries matter less than the weakest authentication layer anywhere in the chain.