// AWSCRITICAL
JetBrains Cadence service was compromised via CVE-2026-63077, an unauthenticated remote-code-execution vulnerability in TeamCity's agent polling protocol (CVSS 9.8). Attackers exploited the flaw between August 8–24, 2026, to access a 2024 Cadence backup containing AWS IAM credentials. The breach exposed source code, configuration files, and project metadata in JetBrains S3 buckets; attackers may also have accessed customer-owned AWS buckets configured with Cadence. JetBrains confirmed the vulnerability was unpatched on its own server for 16 days despite a public advisory on July 27, 2026.
// Get alerts for AWS