Breaches and incidentsBriefReported by a reputable outlet, citing the company
JetBrains Cadence: breached via JetBrains’ own unpatched TeamCity
Attackers exploited CVE-2026-63077 (TeamCity deserialization, unauthenticated RCE, CVSS 9.8, disclosed by JetBrains 27 Jul) on the Cadence cloud-compute...
- Disclosed
What happened
- Attackers exploited CVE-2026-63077 (TeamCity deserialization, unauthenticated RCE, CVSS 9.8, disclosed by JetBrains 27 Jul) on the Cadence cloud-compute server from 8 to 24 Aug; JetBrains found it 23 Aug. Exposed: user names, emails, IPs, a full 2024 server backup, AWS IAM users and secrets (including employees’), S3 files and possibly synced PyCharm project source.
- Attribution: unknown.
- Response: api.cadence.jetbrains.com taken offline, plugin tokens invalidated; JetBrains says the server should have been patched. Users told to rotate all credentials used in Cadence runs and treat run inputs and outputs as untrusted.
Live scores
Live scores
CVE-2026-63077- EPSS
- 0.936
very likely to be attacked soon - VEDAS
- 0.989
strong exploit evidence - On CISA KEV
- Yes, since 2026-08-05
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html
- https://thenewstack.io/jetbrains-told-everyone-to-patch-it-didnt-patch-itself/
- https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.