JETBRAINS is warning Cadence users to revoke and rotate all credentials following a security incident in August 2026, where attackers exploited a recently disclosed critical vulnerability in TeamCity to breach Cadence’s environment. The company said that as the Cadence server was compromised, any credentials or secrets stored in Cadence, in the compromised backup, or used by executions on the affected server should be treated as compromised and rotated. Cadence is a JetBrains-hosted cloud service that runs machine learning and heavy workloads on cloud GPUs from the PyCharm IDE.
The breach stemmed from the exploitation of CVE-2026-63077 (deserialization of untrusted data), with a CVSS score of 9.8, leading to unauthenticated execution and potential access to data stored on the Cadence server. JetBrains disclosed that the threat actors accessed data in a 2024 Cadence server backup and could have reached storage containing data for current Cadence users, including email addresses, project source code, and credentials.
Confirmed accessible items include personal data (usernames, real names, emails, last login timestamps, IPs), a 2024 Cadence backup containing credentials and secrets, multiple AWS IAM users and secrets, and files in S3 buckets. The company has invalidated Cadence plugin access tokens and urged users to audit connected systems and treat all Cadence executions as potentially untrusted while rotating all credentials. The Cadence server identified as api.cadence.jetbrains[.]com has been taken offline.