Posted on

JetBrains Cadence Breach via TeamCity CVE-2026-63077

Threat Overview

JetBrains confirmed that its Cadence hosted development service was breached after an unpatched TeamCity server was exploited using CVE-2026-63077. The vulnerability permits unauthenticated remote command execution against reachable TeamCity On-Premises servers. JetBrains identified malicious activity beginning August 8, discovered exploitation on August 23, and took the Cadence server offline August 24. The company later confirmed exposure involving a 2024 server backup, multiple AWS IAM credentials, S3 data, customer source code, and potentially credentials used in current Cadence executions.

References

Impacted Systems

Vendor/product: JetBrains TeamCity On-Premises and JetBrains Cadence. TeamCity affected: all On-Premises versions before fixed releases 2025.11.7 and 2026.1.3; security patch plugin is available for 2017.1+. TeamCity Cloud is not affected. Attack prerequisite: unauthenticated HTTP(S) reachability to a vulnerable TeamCity server. Cadence affected period: August 8 through August 24, 2026. Potentially exposed data includes credentials/secrets, source code, backups, AWS IAM credentials, and S3 data associated with Cadence use.

Why this matters

The incident demonstrates real-world exploitation of a CI/CD control plane leading to credential theft and cloud access. TeamCity commonly holds high-value secrets and build pipeline trust.

Criticality: Critical

Exploitation Status

Confirmed exploitation. JetBrains states Cadence was exploited through CVE-2026-63077 and separately reports active exploitation attempts against unpatched TeamCity servers.

What this hunt looks for

Available Microsoft Sentinel telemetry can be reviewed for TeamCity server shell execution, unusual Java/TeamCity network connections, persistence writes, AWS CloudTrail activity involving exposed IAM credentials, and credential-related alerts where those sources are ingested.

Required logs

  • Microsoft Defender XDR / Defender for Endpoint tables: DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents
  • AWS CloudTrail ingested as AWSCloudTrail for cloud-credential hunts
  • Microsoft security alerts ingested as SecurityAlert for alert correlation

First Pass – TeamCity Server Spawning Shells

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessCommandLine has_any ("TeamCity", "jetbrains.buildServer") or InitiatingProcessFileName in~ ("java", "java.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "curl", "wget", "nc", "ncat")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA1
| order by TimeGenerated desc

Suspicious Network Connections From TeamCity Java

DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessCommandLine has_any ("TeamCity", "jetbrains.buildServer") or InitiatingProcessFolderPath has_any ("TeamCity", "JetBrains")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated desc

Rare TeamCity Outbound Destinations

let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(2d))
| where InitiatingProcessCommandLine has_any ("TeamCity", "jetbrains.buildServer") or InitiatingProcessFolderPath has_any ("TeamCity", "JetBrains")
| summarize by RemoteUrl, RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(2d)
| where InitiatingProcessCommandLine has_any ("TeamCity", "jetbrains.buildServer") or InitiatingProcessFolderPath has_any ("TeamCity", "JetBrains")
| where (RemoteUrl, RemoteIP) !in (Baseline)
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessCommandLine
| order by TimeGenerated desc

TeamCity or Cadence Related Cloud Credential Use

AWSCloudTrail
| where TimeGenerated > ago(30d)
| extend AccessKey=tostring(UserIdentityAccessKeyId), Arn=tostring(UserIdentityArn), Src=tostring(SourceIpAddress), Event=tostring(EventName)
| where Event has_any ("GetObject", "ListBuckets", "ListObjects", "GetSecretValue", "AssumeRole", "GetCallerIdentity")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=make_set(Event,20), Sources=make_set(Src,20) by AccessKey, Arn
| where array_length(Sources) > 3
| order by LastSeen desc

Unusual AWS IAM Credential Activity After TeamCity Exposure

AWSCloudTrail
| where TimeGenerated > ago(30d)
| extend Event=tostring(EventName), Arn=tostring(UserIdentityArn), Src=tostring(SourceIpAddress)
| where Event has_any ("CreateAccessKey", "UpdateAccessKey", "DeleteAccessKey", "CreateUser", "AttachUserPolicy", "PutUserPolicy", "CreateLoginProfile", "AssumeRole")
| project TimeGenerated, Event, Arn, Src, RequestParameters, ResponseElements, ErrorCode
| order by TimeGenerated desc

TeamCity Host Persistence File Writes

DeviceFileEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessCommandLine has_any ("TeamCity", "jetbrains.buildServer") or InitiatingProcessFolderPath has_any ("TeamCity", "JetBrains")
| where FolderPath has_any ("/etc/cron", "/etc/systemd", "/root/.ssh", @"\Startup\", @"\Tasks\", @"\System32\drivers\etc")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA1
| order by TimeGenerated desc

Credential and Secret Access Alerts

SecurityAlert
| where TimeGenerated > ago(30d)
| where AlertName has_any ("credential", "secret", "token", "AWS", "cloud") or Description has_any ("TeamCity", "Cadence", "AWS IAM", "access key")
| project TimeGenerated, AlertName, AlertSeverity, CompromisedEntity, ProductName, Description
| order by TimeGenerated desc

Detection Notes

Highest signal: TeamCity/Java spawning command interpreters or network tools, followed by unusual cloud API use from new source addresses. TeamCity application/access logs would materially improve confidence. AWS CloudTrail is important for exposed IAM credentials. Generic Java activity is noisy unless constrained to TeamCity paths or command lines.