--- title: Security Incident Affecting JetBrains Cadence | daily.dev description: JetBrains disclosed a security incident affecting Cadence, its cloud execution service integrated with PyCharm. Attackers exploited a critical TeamCity... canonical: https://daily.dev/posts/security-incident-affecting-jetbrains-cadence-cclncnhkw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security Incident Affecting JetBrains Cadence | daily.dev og:description: JetBrains disclosed a security incident affecting Cadence, its cloud execution service integrated with PyCharm. Attackers exploited a critical TeamCity... og:url: https://daily.dev/posts/security-incident-affecting-jetbrains-cadence-cclncnhkw og:image: https://api.daily.dev/og/posts/CclNcNhkW.png og:image:alt: Security Incident Affecting JetBrains Cadence og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security Incident Affecting JetBrains Cadence **[JetBrains](https://daily.dev/sources/jetbrains)** · 6 min read · 2 upvotes · 1 comments ## Summary JetBrains disclosed a security incident affecting Cadence, its cloud execution service integrated with PyCharm. Attackers exploited a critical TeamCity vulnerability (CVE-2026-63077) that had not been patched on the Cadence server, gaining unauthorized access between August 8 and August 24, 2026. Exposed data includes usernames, real names, emails, timestamps, IPs, a 2024 backup containing credentials, and AWS IAM users/secrets belonging to both customers and JetBrains employees. Source code synced from PyCharm to Cadence may also have been accessed. JetBrains took the affected server offline, invalidated Cadence plugin tokens, and urges all users to rotate credentials, review cloud/source-control/package-registry access, and treat all Cadence executions as untrusted. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What caused the JetBrains Cadence security incident in August 2026? Threat actors exploited CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in JetBrains TeamCity, which Cadence used to orchestrate cloud workloads. The Cadence server should have been patched against this vulnerability but was not, allowing exploitation from August 8, 2026 until JetBrains discovered it on August 23 and took the server offline on August 24, 2026. _Teams relying on JetBrains Cadence or TeamCity can track fast-moving incident details like this on daily.dev._ ### What should JetBrains Cadence users do after the August 2026 security incident? Cadence users should immediately revoke and rotate all credentials and secrets used in Cadence executions, including cloud credentials (AWS, Azure, GCP), source control tokens (GitHub, GitLab, Bitbucket), package registry credentials (npm, PyPI, Maven, NuGet), container registry credentials, and SSH/API keys. They should also review connected systems, repositories, and IAM roles for unauthorized changes, since a compromised 2024 backup exposed additional credentials. _Engineers rotating exposed secrets after a breach can follow ongoing security guidance via daily.dev._ ### What data was exposed in the JetBrains Cadence breach? Confirmed exposed personal data includes usernames, real names, email addresses, last-login timestamps, and last-accessed IP addresses. Attackers also compromised a full 2024 backup of the Cadence server containing AWS IAM user credentials, some belonging to JetBrains employees, and accessed files in S3 buckets within JetBrains AWS accounts used by Cadence, with the full scope of data access still under investigation. _Developers assessing breach fallout and exposure scope can follow updates on incidents like this through daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@taiwofrancis** · 1 upvotes > This is the kind of incident that reminds you that one unpatched server can turn into a much bigger problem really quickly. ## Similar posts on daily.dev - [CISA: Ransomware gangs now exploiting critical TeamCity flaw](https://daily.dev/posts/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw-ivphb8400) · BleepingComputer · 1 upvotes · 0 comments - [High-Severity Security Issue Affecting TeamCity On-Premises \(CVE-2026-44413\) – Update to 2026.1 Now](https://daily.dev/posts/high-severity-security-issue-affecting-teamcity-on-premises-cve-2026-44413-update-to-2026-1-now-dryw37woz) · JetBrains · 0 upvotes · 0 comments - [15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers](https://daily.dev/posts/15-malicious-jetbrains-plugins-stole-ai-api-keys-from-70-000-developers-hledivprv) · StepSecurity · 17 upvotes · 5 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#devtools](https://daily.dev/tags/devtools), [#cicd](https://daily.dev/tags/cicd) [View this post on daily.dev](https://daily.dev/posts/security-incident-affecting-jetbrains-cadence-cclncnhkw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security Incident Affecting JetBrains Cadence","url":"https://daily.dev/posts/security-incident-affecting-jetbrains-cadence-cclncnhkw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-incident-affecting-jetbrains-cadence-cclncnhkw"},"datePublished":"2026-08-28T10:40:20.901Z","dateModified":"2026-09-13T20:47:52.025Z","description":"JetBrains disclosed a security incident affecting Cadence, its cloud execution service integrated with PyCharm. Attackers exploited a critical TeamCity...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fe4a7b56309049bd5a17f2d9cd0530cd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fe4a7b56309049bd5a17f2d9cd0530cd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"JetBrains","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"JetBrains","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/53ecf0c676f34b3896ee109609d91efa","url":"https://daily.dev/sources/jetbrains"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/security-incident-affecting-jetbrains-cadence-cclncnhkw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"cyber,devtools,cicd","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"JetBrains","item":"https://daily.dev/sources/jetbrains"},{"@type":"ListItem","position":3,"name":"Security Incident Affecting JetBrains Cadence"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/security-incident-affecting-jetbrains-cadence-cclncnhkw","comment":[{"@type":"Comment","text":"This is the kind of incident that reminds you that one unpatched server can turn into a much bigger problem really quickly.","datePublished":"2026-08-28T12:10:47.172Z","url":"https://daily.dev/posts/CclNcNhkW#c-suS4ikMJr","author":{"@type":"Person","name":"Francis","url":"https://daily.dev/taiwofrancis","image":"https://media.daily.dev/image/upload/s--Eux7Ia33--/f_auto,pg_1/v1792512435/avatars/avatar_FStpm3ZejUD3qGlEeoOUS?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/security-incident-affecting-jetbrains-cadence-cclncnhkw#faq","mainEntity":[{"@type":"Question","name":"What caused the JetBrains Cadence security incident in August 2026?","acceptedAnswer":{"@type":"Answer","text":"Threat actors exploited CVE-2026-63077, a critical unauthenticated remote code execution vulnerability in JetBrains TeamCity, which Cadence used to orchestrate cloud workloads. The Cadence server should have been patched against this vulnerability but was not, allowing exploitation from August 8, 2026 until JetBrains discovered it on August 23 and took the server offline on August 24, 2026. Teams relying on JetBrains Cadence or TeamCity can track fast-moving incident details like this on daily.dev."}},{"@type":"Question","name":"What should JetBrains Cadence users do after the August 2026 security incident?","acceptedAnswer":{"@type":"Answer","text":"Cadence users should immediately revoke and rotate all credentials and secrets used in Cadence executions, including cloud credentials (AWS, Azure, GCP), source control tokens (GitHub, GitLab, Bitbucket), package registry credentials (npm, PyPI, Maven, NuGet), container registry credentials, and SSH/API keys. They should also review connected systems, repositories, and IAM roles for unauthorized changes, since a compromised 2024 backup exposed additional credentials. Engineers rotating exposed secrets after a breach can follow ongoing security guidance via daily.dev."}},{"@type":"Question","name":"What data was exposed in the JetBrains Cadence breach?","acceptedAnswer":{"@type":"Answer","text":"Confirmed exposed personal data includes usernames, real names, email addresses, last-login timestamps, and last-accessed IP addresses. Attackers also compromised a full 2024 backup of the Cadence server containing AWS IAM user credentials, some belonging to JetBrains employees, and accessed files in S3 buckets within JetBrains AWS accounts used by Cadence, with the full scope of data access still under investigation. Developers assessing breach fallout and exposure scope can follow updates on incidents like this through daily.dev."}}]} ```