Attackers Breach JetBrains Cadence via Unpatched TeamCity, Extract AWS Credentials

JetBrains announced last month that unidentified threat actors exploited a critical vulnerability in its TeamCity continuous integration/server automation platform to breach the company's Cadence cloud-based orchestration environment. The exploitation occurred last month and was disclosed in September 2026. The actors successfully extracted AWS credentials from the compromised environment. In response, JetBrains urged all Cadence users to immediately revoke and rotate all credentials and secrets that may have been used to run their Cadence executions. The company has not detailed the specific CVE associated with the TeamCity vulnerability in the advisory, but emphasized that users should ensure their TeamCity instances are updated to the latest patched version to mitigate the risk of similar exploitation. The identity of the threat actors remains unknown, and the full scope of affected users and credentials has not been specified.