Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

Summary

JetBrains urged Cadence users to rotate all credentials after threat actors breached its cloud infrastructure using an unpatched TeamCity vulnerability. The attackers accessed historic server backups, personal user data, and AWS IAM credentials.

Key Takeaways

1. JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment.
2. The attack, per the software development company, involved the exploitation of CVE-2026-63077 (CVSS score: 9.8) to breach the affected Cadence environments.
3. The company conceded that the server in question should have been patched as part of its own vulnerability response efforts, but did not share any details as to why this did not happen.

Statement Breakdown

• Claimed Facts: 75% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 5% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article reports directly on a confirmed corporate security advisory from JetBrains, citing technical vulnerability identifiers, official statements, and specific remediation steps. Findings are substantiated by reference to the CISA Known Exploited Vulnerabilities catalog.

Bias assessment: Technical and Incident-Focused. The reporting maintains a standard journalistic and technical security register, conveying verified advisories without sensationalism. It directly notes JetBrains' failure to patch its own server without editorial speculation.

Note: Based on official vendor advisories and government vulnerability catalog entries.

Credibility flag: Verified Incident

Claimed Facts (5)

• Documents the formal addition of the vulnerability to CISA's catalog on a specific date.
• Specifies the exact discovery date of the breach.
• Provides a factual technical definition of the Cadence service.
• Describes a concrete containment action taken by the vendor.
• Confirms revocation of access tokens across the plugin ecosystem.

Opinions (4)

• Expresses a defensive precautionary recommendation rather than a verified compromise of all workloads.
• Provides risk forecasting and expected threat actor behavior following the leak.
• Represents vendor remediation guidance directed toward end users.
• Offers an internal engineering assessment regarding the scope of affected accounts.

Claims (5)

• Highlights the total lack of attribution or definitive evidence regarding the threat actor identity.
• Speculative potential impact that JetBrains has not conclusively confirmed with forensic evidence.
• Describes hypothetical access capabilities rather than confirmed data exfiltration.
• Relies on early audit results while the scope of accessed storage remains uncertain.
• Contains an obvious typographical error in the text citing a 20224 backup, introducing dating ambiguity.

Key Sources

• JetBrains — Software development tool vendor and operator of Cadence
• Daniel Gallo — Solutions Engineering Lead at JetBrains
• Cybersecurity and Infrastructure Security Agency — United States federal cybersecurity agency
• Ravie Lakshmanan — Security Journalist at The Hacker News