Vulnerabilities & Exploits · Web App Attack

TeamCity breach reached JetBrains Cadence backup

JetBrains said attackers used TeamCity CVE-2026-63077 to break into its own Cadence environment and reach a 2024 backup that held credentials and user data. The company says the incident was discovered in August and that the same affected user group it contacted earlier is still the scope of concern.

The flaw let an unauthenticated attacker hit TeamCity’s agent-polling path and run commands on the server. Once inside Cadence, the attackers could get data stored there, data inside the backup, and secrets made available to executions, which is why JetBrains is treating current-user emails, source code, and cloud credentials as potentially exposed.

For teams that use a job runner or CI/CD system to access cloud accounts, registries, or repositories, the exposure does not stop at the patched host. If execution secrets or backups sit on the same server, a server compromise can turn into downstream access even after the original bug is fixed.

1 source · Sep 5

CVE-2026-63077

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: in JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent…

CISA federal remediation date Aug 8 · date passed

Timeline

Sources

Part of the PlainSec briefing for 2026-09-07

Every edition of this story: TeamCity breach reached JetBrains Cadence backup

More from today