CVE-2026-63077 is a deserialization of untrusted data flaw, and the path is short: an unauthenticated attacker who can reach a TeamCity server bypasses its authentication checks and executes operating system commands with the privileges of the TeamCity server process [3]. CVSS 9.8 [2]. No credential, no user interaction, and the process it lands in is the one holding build secrets.
CISA added the flaw to the Known Exploited Vulnerabilities catalog on August 5, 2026 [4]. JetBrains dates the intrusion from August 8 [5], three days later [1]. Detection came on August 23 [6], fifteen days after the first activity it now attributes to the actor [2]. JetBrains says the server should have been patched as part of its own vulnerability response and has not said why it was not [7].
Cadence runs machine learning and heavy workloads on cloud GPUs from inside PyCharm [18], which is why the secrets sitting in it were cloud credentials. Confirmed compromised: a full 2024 backup of the Cadence server holding credentials, configuration, artifacts and logs [8], and multiple AWS IAM users with their associated secrets extracted from that backup, including IAM users belonging to JetBrains employees who used the service [9]. A backup written in 2024 and read in 2026 puts those credentials at roughly two years old [4], which matters for long-lived IAM users and not much for short-lived ones.
JetBrains' indicator list shows where the company expects those credentials to be spent: unexpected repository clones or downloads, unexpected commits, changes to repository secrets, webhooks, collaborators or permissions, new or modified personal access tokens, API tokens or SSH keys in external services, and new service accounts [13]. Those indicators point to the customer's own source control and cloud accounts, not the Cadence server itself. Six exploitation IP addresses are published [14], and they only work against logs retained from August 8 onwards [14].
Attribution is open. JetBrains says it is not clear who is behind the activity [15]. On scope, Daniel Gallo, the company's Solutions Engineering Lead, says the storage findings affect the same group of users JetBrains had already contacted directly and identified no additional affected users, with that data treated as potentially exposed [16].
For Cadence users the remediation is rotation and nothing else: api.cadence.jetbrains.com is offline, so there is no server left for them to patch [17]. Anyone running a TeamCity server reachable from the internet is in the position JetBrains was in on August 8, against an exploit that was already in KEV [4] and that worked on the company that ships the product [7].
