JetBrains Cadence Server Remained Unpatched for CVE-2026-63077, Allowing Extraction of 2024 Backup Containing AWS IAM Credentials

JetBrains disclosed that the Cadence server, which syncs PyCharm projects to cloud GPUs, was reachable via the critical TeamCity vulnerability added to CISA KEV on 5 August. The actor retrieved a full 2024 server backup holding usernames, emails, source code artifacts, and multiple AWS IAM credentials belonging to both users and JetBrains staff. The company admitted the server should have been patched under its own vulnerability process but offered no timeline or compensating control details. Procurement and incident patterns show repeated delays in patching build and orchestration servers even after public exploits appear. Similar gaps appeared in prior JetBrains tooling exposures where TeamCity instances hosted customer pipelines. The 2024 backup window means any credentials or tokens issued before mid-2025 remain suspect regardless of later rotations. Cadence users must treat all executions and stored secrets as untrusted; JetBrains has invalidated plugin tokens and taken the server offline. Independent monitoring of public TeamCity instances will likely surface additional compromises before year-end as the same unauthenticated RCE path remains high-value for credential harvesting.