JetBrains Had The Patch And Skipped Itself
The Patch That Stopped At The Door
JetBrains shipped a fix for CVE-2026-63077, a maximum-severity flaw in TeamCity, its continuous-integration server, to every customer running the product on their own infrastructure. It did not apply that fix to the TeamCity server running Cadence, its own hosted cloud development service, which means JetBrains was running its own product, unpatched, for itself. CVE-2026-63077 carries a CVSS score of 9.8: an unauthenticated attacker can execute code on the server with no login required and no credential to steal first. Attackers reached the unpatched Cadence server on August 8, 2026, and stayed for sixteen days. JetBrains found them on August 23 and took the server offline the following day, August 24. The company's own account of the incident states plainly that the server 'should have been patched... but was not.' No exotic technique got them in. The technique was the one already described, in detail, in JetBrains' advisory to customers about this same flaw.
What Sixteen Days Buys
What the sixteen days produced, according to JetBrains' own disclosure, was a 2024 backup of the Cadence server containing usernames, emails and login IP addresses, sitting alongside multiple AWS Identity and Access Management credentials, the contents of Amazon S3 storage buckets, and source code that PyCharm, JetBrains' own code editor, had synced up to Cadence on customers' behalf. An AWS IAM credential is not a password to a website. It is a key to a customer's cloud account, the kind that can spin up servers, read storage, or reach further into whatever else that account touches. JetBrains' advisory tells every Cadence user to 'immediately revoke or rotate all credentials and secrets' used in Cadence executions. That is the correct instruction. It is also the instruction the company did not follow for its own server. The attackers already had sixteen days with a working backup, live credentials and synced source before anyone outside JetBrains knew to look.
Patch Lag, Not Tradecraft
The same week, researchers at Sansec found an unauthenticated remote-code-execution flaw dubbed StyleSmuggler running against Magento Open Source and Adobe Commerce stores, exploited since September 4 with no CVE number and no patch as of this writing (Adobe's next scheduled release is September 8). CERT Polska warned that MikroTik routers were being hijacked over SSH with no authentication at all, a campaign MikroTik has since patched across three separate RouterOS releases. Three different categories of infrastructure, CI/CD tooling, online storefronts, network edge devices, hit the same week by the same class of flaw: get in without a password. Two of the three had no fix available yet. JetBrains' had one, written and shipped, sitting unapplied on its own server. Most flaws called sophisticated this year turn out to be unpatched software and stolen credentials, not novel technique; this week supplied three data points confirming it, one of them from a vendor whose product is supposed to catch exactly this. The people who feel it are not abstract. Cadence exists so small development teams do not have to run their own build server; that convenience now comes with someone else's patch backlog attached.
The Cadence server is offline and the advisory is out; whether that is enough now depends on sixteen days JetBrains cannot get back for its customers. The control that would have changed this outcome already existed: JetBrains' own patch, written, tested, shipped to everyone except the server running JetBrains. Revoking a key is fast. Knowing exactly which sixteen days of access to assume against is not.
Sources
- JetBrains Breach Exposes AWS Credentials Via Unpatched TeamCity Flaw (thehackernews.com)
- JetBrains Blog official incident disclosure (blog.jetbrains.com)
- Zero Day In Magento And Adobe Commerce Backdoors Online Stores (thehackernews.com)
- Attackers Hijack MikroTik Routers With No Authentication Needed (thehackernews.com)