How Attackers Breached JetBrains' Cadence Cloud Service—and Walked Out With AWS Credentials
Table of Contents
- A Server That Should Have Been Patched
- What Cadence Actually Is
- CVE-2026-63077: A 9.8 Sitting Unpatched on JetBrains' Own Infrastructure
- The Sixteen-Day Window Nobody Noticed
- What Actually Left the Building
- Why a 2024 Backup Made Things Worse
- JetBrains' Response Once It Found Out
- The Uncomfortable Irony Here
- What This Means If You Use Cadence—or Anything Like It
- Building the Discipline That Closes Gaps Like This
- Final Thoughts
Even the companies that build developer tools for a living can miss their own patch cycle—and when they do, the consequences can land on every customer who trusted that infrastructure.
On September 5, 2026, JetBrains disclosed that attackers breached its Cadence cloud service by exploiting a vulnerability in TeamCity, JetBrains' own CI/CD product, that the company itself had failed to patch on the affected server.
1. A Server That Should Have Been Patched
JetBrains was direct about the root cause in its disclosure: the compromised server should have been patched as part of its vulnerability response efforts, but the company offered no explanation for why it wasn't.
That's a striking admission—not a novel zero-day nobody could have anticipated, but a known, already-disclosed vulnerability sitting unpatched on infrastructure belonging to the very company that makes the patch management and CI/CD tooling many organizations rely on.
This highlights one of the most important principles in modern infrastructure security: identifying a vulnerability is only the first step. Organizations must also prioritize, patch, verify, and continuously monitor vulnerable systems.
For professionals building a career in infrastructure and cloud technologies, understanding these operational security practices is just as important as learning individual tools.
Learn DevOps and CI/CD practices at Innovative Academy
2. What Cadence Actually Is
Cadence is a JetBrains-hosted cloud service, integrated directly with PyCharm, that lets developers run machine learning workloads and other computationally intensive jobs on cloud GPUs straight from their IDE.
It's the kind of convenience feature that's become increasingly common as AI and ML development have moved into everyday developer workflows—trading local compute constraints for a cloud service a developer trusts implicitly because it's built into a tool they already use daily.
That tight integration is also exactly what makes a breach of the service so consequential.
A tool developers reach for constantly, without a second thought about its security posture, is precisely the kind of dependency that can turn a single infrastructure failure into a much wider blast radius.
This is one reason cloud security, networking, Linux administration, and DevOps have become critical skills for modern IT professionals.
Explore AWS Cloud Training at Innovative Academy
3. CVE-2026-63077: A 9.8 Sitting Unpatched on JetBrains' Own Infrastructure
The vulnerability at the center of this breach is CVE-2026-63077, a deserialization flaw in TeamCity carrying a CVSS score of 9.8.
Deserialization vulnerabilities are particularly dangerous because they can allow an attacker to craft malicious data that, when processed by a vulnerable application, executes as code rather than being treated as inert data.
In this case, the vulnerability allowed a completely unauthenticated attacker to bypass authentication and execute arbitrary operating system commands with the server process's own privileges.
CVE-2026-63077 was publicly disclosed in July 2026, and CISA added it to its Known Exploited Vulnerabilities catalog on August 5, 2026—a clear public warning that the vulnerability was being actively exploited.
The incident demonstrates why vulnerability management cannot depend solely on periodic security audits. Organizations need a continuous process for monitoring newly disclosed vulnerabilities, assessing exposure, prioritizing critical issues, and applying patches quickly.
Why a CVSS 9.8 Vulnerability Matters
- Unauthenticated access: Attackers may not need valid credentials.
- Remote exploitation: The vulnerable service can potentially be attacked remotely.
- Arbitrary command execution: Attackers may execute commands with the application's privileges.
- High business impact: Compromise of infrastructure can expose credentials, data, and connected cloud resources.
These concepts are especially relevant for professionals working with Linux servers, AWS infrastructure, networking, and DevOps pipelines.
Learn Linux and server administration
4. The Sixteen-Day Window Nobody Noticed
According to JetBrains' timeline, the intrusion into Cadence ran from August 8 through August 24, 2026—sixteen days of attacker access before the company discovered the exploitation on August 23.
Public disclosure followed on September 5.
That gap between a vulnerability landing on CISA's actively exploited list and an organization's affected server still sitting unpatched, followed by a further detection lag once attackers actually got in, is a pattern worth examining.
Each stage of that timeline represents a point where faster action could have prevented or shortened the damage.
A mature security operation therefore needs several layers of defense:
- Continuous vulnerability monitoring
- Risk-based patch prioritization
- Configuration management
- Centralized logging and monitoring
- Credential rotation
- Incident response procedures
- Regular security audits
5. What Actually Left the Building
The scope of what attackers accessed is substantial.
Exposed information included:
- Usernames
- Real names
- Email addresses
- Login timestamps
- IP addresses
- A full 2024 server backup
- Credentials and configurations
- Artifacts and logs
- AWS IAM user credentials and secrets
- Files stored in JetBrains' AWS S3 buckets
Multiple AWS IAM users and their associated credentials and secrets tied to Cadence—including employee accounts—were compromised.
JetBrains also flagged the possibility that attackers may have exposed source code synchronized from customers' PyCharm projects, given how Cadence integrates directly with the IDE.
This is a powerful example of why cloud IAM security and least-privilege access are fundamental components of modern DevOps.
Build practical AWS and cloud infrastructure skills
6. Why a 2024 Backup Made Things Worse
The presence of a full 2024 backup in what attackers accessed is a detail worth dwelling on.
It illustrates a risk that's easy to overlook: old backups often contain credentials and configurations that were valid at the time they were created.
If those credentials were never rotated, an old backup can remain a security liability long after the original system has been replaced.
An organization can do everything right about securing its current production environment and still be exposed by a two-year-old backup sitting in storage with secrets nobody thought to rotate once the backup itself was no longer the active system.
How Organizations Can Reduce Backup Risk
- Never store plaintext credentials in backups.
- Rotate credentials regularly.
- Use dedicated secrets-management solutions.
- Encrypt sensitive backup data.
- Restrict backup access using IAM policies.
- Regularly test backup restoration and security.
- Delete obsolete backups according to a defined retention policy.
7. JetBrains' Response Once It Found Out
Once the breach was identified, JetBrains took several immediate steps.
The company took api.cadence.jetbrains.com offline, invalidated every Cadence plugin access token in circulation, and published six IP addresses associated with the exploitation activity to help affected organizations check their execution logs.
JetBrains also advised Cadence users to immediately revoke or rotate credentials and secrets that may have been used to run Cadence executions.
Customers were advised to audit their AWS accounts, S3 buckets, repositories, and deployment environments for signs of unauthorized activity.
The response demonstrates an important incident-response principle: once compromise is suspected, organizations must move quickly to contain the incident, invalidate exposed credentials, investigate activity, and prevent persistence.
8. The Uncomfortable Irony Here
There's a pointed irony worth naming plainly.
TeamCity is itself a CI/CD and DevOps tool, built specifically to help organizations automate and manage their software delivery pipelines. Yet the vulnerability that enabled this breach was found in TeamCity running on JetBrains' own infrastructure.
It's a reminder that no organization—including one whose entire business is building developer tooling—is exempt from the basic discipline of tracking vulnerability-response commitments and actually following through on them.
Technology doesn't replace operational discipline.
Automation doesn't eliminate the need for monitoring.
And having sophisticated security tools doesn't guarantee that critical patches will be applied on time.
This is one of the central lessons of DevOps: people, processes, automation, monitoring, and security must work together.
Explore the DevOps Bootcamp at Innovative Academy
9. What This Means If You Use Cadence—or Anything Like It
For any organization using Cadence—or any similar cloud-integrated developer tool with access to cloud infrastructure credentials—the practical takeaway is direct:
- Rotate every credential the tool may have touched.
- Do not assume that unused credentials are automatically safe.
- Audit AWS IAM activity.
- Review S3 access logs.
- Check repositories for unauthorized activity.
- Review deployment environments.
- Search logs for suspicious activity during the affected window.
- Remove unnecessary standing credentials.
More broadly, this incident is a useful prompt to inventory every third-party developer tool with standing access to cloud credentials across an organization.
Security teams should ask:
- What cloud resources can each integration access?
- What credentials does each tool possess?
- Are those credentials permanent or temporary?
- What would happen if the vendor's infrastructure were compromised?
- How quickly would suspicious activity be detected?
- Can access be revoked immediately?
IAM policies that are tightly scoped to what each integration actually needs, rather than broad standing access that is granted once and never revisited, can significantly limit the blast radius of a compromise.
10. Building the Discipline That Closes Gaps Like This — Innovative Academy
The JetBrains incident highlights why modern DevOps professionals need more than familiarity with individual tools.
Effective DevOps requires an understanding of Linux, networking, cloud infrastructure, CI/CD, containers, infrastructure as code, automation, security, and monitoring.
At Innovative Academy, learners can build practical skills across networking, Linux, AWS, and DevOps technologies through hands-on training and real-time project exposure.
Our DevOps Bootcamp focuses on technologies and practices such as:
- Linux
- Git and GitHub
- Jenkins
- Docker
- Kubernetes
- Ansible
- Terraform
- AWS
- CI/CD pipelines
- Infrastructure as Code
Security and operational discipline are increasingly important parts of a DevOps career. Understanding how vulnerabilities move from disclosure to exploitation—and how teams can prevent that gap—is valuable knowledge for anyone working with production infrastructure.
Explore AWS Training | Explore Linux Training | Explore DevOps Training
11. Final Thoughts
What makes the JetBrains Cadence breach worth remembering isn't a clever new attack technique.
It's the plain fact that a known, publicly disclosed, actively exploited vulnerability sat unpatched on production infrastructure at a company whose core business is building the tools other organizations use to manage software development and delivery.
That's not a story about JetBrains being uniquely careless. It's a story about how easy it is for any organization, however sophisticated, to let a patch commitment slip through the cracks of a busy operational calendar.
And when that vulnerability happens to sit on infrastructure holding real cloud credentials, the consequences can be severe.
For anyone building a career in DevOps or cloud infrastructure, the lesson here is less about any single technical control and more about operational follow-through.
Tracking known vulnerabilities against your environment isn't a one-time audit. It's a continuous discipline.
The gap between identifying a fix that is needed and actually applying it is precisely where incidents like this one can happen.
Modern infrastructure teams therefore need to treat vulnerability management, credential security, IAM, monitoring, patching, and incident response as continuous operational responsibilities—not occasional security exercises.
In cybersecurity, knowing about the vulnerability is not enough. The real protection begins when the fix is actually applied.
