JetBrains breach exposes user data after company fails to patch its own TeamCity flaw

JetBrains disclosed on August 29, 2026, that attackers breached its Cadence cloud development service by exploiting a critical vulnerability in the company's own TeamCity continuous integration software — a flaw JetBrains had already patched and publicly disclosed a month earlier, but had failed to apply to the affected server itself.

What Happened

The attackers exploited CVE-2026-63077, a TeamCity vulnerability disclosed in July 2026 that allows an unauthenticated attacker to execute operating system commands on a vulnerable server by abusing the TeamCity agent polling protocol to bypass authentication checks. JetBrains identified malicious activity beginning August 8, 2026, but did not discover the exploitation until August 23. The company took the affected server, api.cadence.jetbrains.com, offline the following day.

"The server should have been patched as part of our response to the vulnerability, but it was not," JetBrains said in its disclosure. "We sincerely apologize for this failure and the impact it may have on you."

What Was Exposed

Cadence is a JetBrains-hosted service that integrates with the PyCharm IDE through an optional plugin, letting developers run projects on cloud compute resources orchestrated by TeamCity. The attackers accessed and extracted personal information including usernames, real names, email addresses, last-login timestamps, and the IP addresses users most recently connected from. JetBrains also confirmed the attackers compromised a full backup of the Cadence server dating from 2024.

The company said its investigation so far has found no evidence that secrets were extracted from the current Cadence environment, but the probe is ongoing. As a precaution, JetBrains invalidated all access tokens used by the Cadence plugin in PyCharm and advised affected users to revoke or rotate any credentials and secrets that may have been used during Cadence executions, treating the inputs and outputs of those executions as potentially compromised.

Why This Matters Beyond JetBrains

TeamCity is one of the most widely deployed CI/CD orchestration tools in enterprise software development, used to automate builds, tests, and deployments across thousands of organizations. CVE-2026-63077 affects TeamCity On-Premises installations broadly, not just JetBrains' own Cadence server — meaning any organization running an unpatched, internet-exposed TeamCity server was vulnerable to the same unauthenticated remote code execution attack for the roughly six weeks between the July disclosure and now.

The incident is a pointed reminder that even the vendor that discloses and patches a vulnerability can fail to apply its own fix in time — and that CI/CD systems, which routinely hold credentials, source code access, and deployment pipelines, are high-value targets once compromised.

What Affected Developers Should Do

Anyone who used the JetBrains Cadence service between August 8 and August 24, 2026 should rotate any API keys, tokens, or credentials that were accessible to Cadence executions during that window, and review recent Cadence run outputs for signs of tampering. Organizations running self-hosted TeamCity On-Premises servers should confirm they have applied the CVE-2026-63077 patch immediately if they have not already done so.

This story is based on JetBrains' official security disclosure and reporting by ADTmag.