---
title: "Security Incident Affecting JetBrains Cadence"
description: "JetBrains reports a security incident affecting Cadence, its hosted service that integrates with PyCharm through an optional plugin and runs projects on cloud compute resources. Cadence used TeamCity to orchestrate workloads, and attackers exploited the environment through critical vulnerability CVE-2026-63077. The attackers accessed personal data, compromised a 2024 server backup and Cadence-related AWS IAM credentials, and accessed files in JetBrains AWS S3 buckets; the scope remains under investigation. JetBrains discovered the exploitation on August 23, took the server offline on August 24, invalidated plugin access tokens, and urges users to rotate secrets, investigate connected systems, review repositories, and treat executions and synchronized files as untrusted."
---

# Security Incident Affecting JetBrains Cadence

[Jetbrains](https://yomu.fyi/company/jetbrains) · Daniel Gallo · Aug 28, 2026

**Type:** Incident / postmortem

## Summary

JetBrains reports a security incident affecting Cadence, its hosted service that integrates with PyCharm through an optional plugin and runs projects on cloud compute resources. Cadence used TeamCity to orchestrate workloads, and attackers exploited the environment through critical vulnerability CVE-2026-63077. The attackers accessed personal data, compromised a 2024 server backup and Cadence-related AWS IAM credentials, and accessed files in JetBrains AWS S3 buckets; the scope remains under investigation. JetBrains discovered the exploitation on August 23, took the server offline on August 24, invalidated plugin access tokens, and urges users to rotate secrets, investigate connected systems, review repositories, and treat executions and synchronized files as untrusted.

## Context

The Cadence server used TeamCity to orchestrate workloads and was vulnerable to CVE-2026-63077, a critical vulnerability that can allow an unauthenticated attacker to execute arbitrary commands on a vulnerable server. The affected server was api.cadence.jetbrains.com, with exploitation identified from August 8 through August 24, 2026.

## Approach / What changed

JetBrains took the affected server offline on August 24, invalidated all access tokens used by the Cadence plugin, contacted affected users, notified relevant authorities, and continued investigating. Users are advised to revoke or rotate credentials and secrets, inspect connected systems and repositories, and treat Cadence executions, synchronized files, and associated data as potentially untrusted.

## Takeaways

- Confirmed exposed data includes usernames, real names, email addresses, last-login timestamps, and last accessed IP addresses.
- A compromised 2024 Cadence server backup may contain credentials, configuration, artifacts, logs, or other data, and Cadence-related AWS IAM credentials and S3 files were also accessed.
- Cadence users should rotate credentials used by executions, review cloud and source-control activity, and treat execution inputs, outputs, and synchronized project files as potentially compromised.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [AWS](https://yomu.fyi/topic/aws), [Incident Response](https://yomu.fyi/topic/incident-response), [Python](https://yomu.fyi/topic/python)

- Source: [Jetbrains](https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026)
- Source URL: https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026
- Ingested by Yomu: 2026-08-28T12:00:46.021Z

[Read original post](https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026)