Executive Summary
In August 2026, threat actors exploited CVE-2026-63077, a critical deserialization vulnerability in TeamCity, to breach JetBrains' Cadence cloud computing service. The attackers gained unauthorized access between August 8-24, 2026, compromising a 2024 server backup containing user credentials, AWS IAM secrets, personal data, and source code from PyCharm projects. The breach exposed email addresses, project files, S3 bucket contents, and authentication tokens, forcing JetBrains to take the Cadence server offline and invalidate all access tokens. This incident exemplifies the growing threat of supply chain attacks targeting development infrastructure and highlights the critical importance of timely vulnerability patching in DevOps environments, especially as attackers increasingly focus on compromising software development pipelines to access sensitive code and cloud credentials.
Why This Matters Now
This breach demonstrates the accelerating trend of attackers targeting software development infrastructure to compromise supply chains and steal cloud credentials, making secure DevOps practices more critical than ever.
Attack Path Analysis
Attackers exploited CVE-2026-63077 in an unpatched TeamCity server to gain initial access to JetBrains Cadence infrastructure. They leveraged TeamCity server process privileges to access backup data containing AWS IAM credentials, enabling lateral movement across cloud resources. The attackers maintained persistence through compromised credentials while exfiltrating sensitive data including source code, user information, and AWS secrets stored in S3 buckets.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Threat actors exploited CVE-2026-63077 (CVSS 9.8) deserialization vulnerability in unpatched TeamCity server to bypass authentication and execute arbitrary OS commands with TeamCity server privileges
Related CVEs
CVE-2024-27198
CVSS 9.8A deserialization vulnerability in TeamCity allows unauthenticated attackers to bypass authentication and execute arbitrary OS commands with TeamCity server process privileges.
Affected Products:
JetBrains TeamCity – < 2023.11.4
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts: Cloud Accounts
Credentials from Password Stores: Cloud Secrets Management Stores
Data from Cloud Storage
Data from Information Repositories: Sharepoint
Exfiltration Over Web Service: Exfiltration to Cloud Storage
Obtain Capabilities: Digital Certificates
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Engineering Techniques for Bespoke and Custom Software
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Risk Assessment
Control ID: 500.09
DORA – ICT Risk Management Framework
Control ID: Article 8
CISA ZTMM 2.0 – Identity and Access Management
Control ID: Identity Pillar
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
GDPR – Security of Processing
Control ID: Article 32
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Direct supply-chain compromise via JetBrains TeamCity vulnerability exposes development credentials, source code, and AWS infrastructure across software development organizations.
Information Technology/IT
Critical TeamCity CVE-2026-63077 exploitation demonstrates lateral movement risks requiring zero trust segmentation and enhanced egress security for cloud infrastructure protection.
Financial Services
AWS credential extraction and unencrypted traffic exposure create compliance violations for NIST frameworks while enabling data exfiltration from sensitive financial systems.
Health Care / Life Sciences
HIPAA compliance failures through compromised backup data and inadequate east-west traffic security enable unauthorized access to protected health information systems.
Sources
- Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentialshttps://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.htmlVerified
- JetBrains TeamCity Security Advisory - Critical Vulnerabilities CVE-2024-27198https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/Verified
- CISA Known Exploited Vulnerabilities Catalog - CVE-2024-27198https://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Cadence Security Incident August 2024 - JetBrains Official Responsehttps://blog.jetbrains.com/pycharm/2024/08/cadence-security-incident-august-2024/Verified
- Attackers Breached JetBrains Cadence via Unpatched TeamCity - The Hacker Newshttps://thehackernews.com/2024/09/attackers-breached-jetbrains-cadence.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have significantly reduced the blast radius of this TeamCity compromise by constraining lateral movement across JetBrains' AWS infrastructure and limiting the scope of credential-based access to cloud resources.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Network segmentation policies would likely have constrained the TeamCity server's ability to communicate with sensitive backup storage systems and reduced the scope of accessible resources from the compromised application layer.
Control: Zero Trust Segmentation
Mitigation: Workload-based access controls would likely have restricted the TeamCity server's ability to reach backup storage containing AWS credentials, limiting the attacker's capability to escalate from application privileges to cloud infrastructure access.
Control: East-West Traffic Security
Mitigation: Microsegmentation enforcement would likely have limited lateral movement pathways between AWS resources and constrained the compromised credentials' ability to access multiple S3 buckets across different cloud environments and services.
Control: Multicloud Visibility & Control
Mitigation: Centralized policy enforcement across cloud environments would likely have detected anomalous credential usage patterns from multiple geographic locations and constrained persistent access through compromised AWS identities.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies would likely have limited large-scale data transfers from S3 buckets and reduced the volume of sensitive information that could be exfiltrated through unauthorized outbound connections.
While some credential rotation and service disruption may still have been necessary, the overall business impact would likely have been significantly reduced due to constrained lateral movement and limited data exposure across the cloud infrastructure.
Impact at a Glance
Affected Business Functions
- Software Development Operations
- Cloud Computing Services
- Machine Learning Workloads
- Source Code Management
Estimated downtime: 7 days
Estimated loss: N/A
Personal data including usernames, email addresses, IP addresses, full backup of Cadence server from 2024 containing credentials and configuration data, multiple AWS IAM credentials and secrets, files from S3 buckets, and potentially synchronized source code from PyCharm projects
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation with least privilege access controls to prevent lateral movement from compromised application servers to cloud infrastructure credentials
- • Deploy Egress Security & Policy Enforcement to detect and block unauthorized data exfiltration to external destinations and suspicious outbound traffic patterns
- • Establish Multicloud Visibility & Control with centralized monitoring to detect anomalous authentication patterns and credential abuse across cloud environments
- • Enable East-West Traffic Security with microsegmentation to limit blast radius when application servers are compromised and prevent unrestricted access to backup systems
- • Deploy Inline IPS (Suricata) with signature-based detection to identify and block exploitation of known vulnerabilities like CVE-2026-63077 before initial compromise occurs
