Attackers are exploiting a critical flaw in self-hosted (Data Center) versions of Atlassian Jira,
Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye that lets anyone on the internet read
files from the server without logging in. In some setups those files hold passwords that can lead to full
administrator control. Organisations running these products on their own servers should install
Atlassian’s fixed versions now, or take the servers off the internet until they can.
1. Vulnerability Details
CVE ID – CVE-2026-21589
CVSS SCORE – 9.3 (Critical) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
EXPLOIT STATUS – Exploitation in the wild reported; public detection script available
Atlassian describes an arbitrary file access flaw that lets an unauthenticated attacker read specific files inside the web
application root, provided they know the exact file name and path. watchTowr traced it to the shared atlassian-plugins
webresource library (6.0.7 vulnerable, 6.0.8 fixed), where the Router converts “::” into “/”. Sequences such as “..::” pass
traversal checks and reach a deprecated resource lookup, exposing WEB-INF files such as web.xml. Reads stay inside
the Tomcat context. Atlassian lists no CWE identifier.
2. Affected Products & Fixed Versions
| COMPONENT | VULNERABLE VERSIONS | FIXED BUILD |
| Bitbucket Data Center | All versions prior to fix | 9.4.26, 10.2.8, 10.5.1 |
| Confluence Data Center | All versions prior to fix | 9.2.26, 10.2.19 |
| Jira Service Management Data Center | All versions prior to fix | 5.12.40, 10.3.26, 11.3.12 |
| Jira Software Data Center | All versions prior to fix | 9.12.40, 10.3.26, 11.3.12 |
| Bamboo Data Center | All versions prior to fix | 10.2.24, 12.1.12 |
| Crowd Data Center | All versions prior to fix | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Crucible | All versions prior to fix | 4.9.15 |
| Fisheye | All versions prior to fix | 4.9.15 |
3. Observed Activity
Atlassian released the advisory on 5 October 2026 and has patched its Cloud products, with no Cloud customer action
required. watchTowr published technical details and a detection script on 6 October.
Honeypot attempts (6 to 7 October 2026): Previdian recorded 15 exploitation attempts from 3 IP addresses in Japan
and the US, starting about 2 hours after watchTowr’s details went public. watchTowr reports attackers fingerprinting
products and sweeping for configuration files, with no post-compromise activity seen so far.
KEV listing (7 October 2026): VulnCheck added CVE-2026-21589 to its Known Exploited Vulnerabilities list after
observing activity against Bamboo Data Center. The Canadian Centre for Cyber Security also reported exploitation.
CISA had not listed the CVE as of 8 October.
Crowd credential path to admin (researcher lab): Where Jira or Confluence uses Crowd for sign-in, WEB
INF/classes/crowd.properties stores the Crowd application password in plaintext. watchTowr read it, then used the
Crowd REST API to create a user and add it to jira-administrators. This chain has not been reported in the wild and
needs network access to Crowd.
4. Indicators of Compromise (IOCs)
TYPE- INDICATOR
IP- 38[.]60[.]157[.]86
IP- 146[.]70[.]187[.]234
IP-159[.]26[.]119[.]225
5. Recommendations
- Find every Bitbucket, Confluence, Jira, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center instance, starting with internet-facing ones. Atlassian Cloud customers need no action.
- Upgrade to Atlassian’s fixed versions. If you cannot patch yet, remove the instance from the internet or apply Atlassian’s WAF regex, Tomcat RewriteValve, or Bitbucket urlrewrite.xml rule.
- Search web access logs, URL-decoded up to twice, for “..” next to “/”, “”, or “::”, and for requests that returned web.xml, urlrewrite.xml, or crowd. properties.
- If crowd.properties may have been read, rotate the Crowd application password, restrict Crowd to an IP allowlist, and check Crowd for new users or new jira-administrators members.
- Monitor for the IOCs. Block the IOCs at their respective controls.
6. Sources
- https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html
- https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluenc
e-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/ - https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589
- https://thehackernews.com/2026/10/atlassian-data-center-flaw-draws.html
- https://www.cyber.gc.ca/en/alerts-advisories/atlassian-security-advisory-av26-1002
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.