Atlassian CVE-2026-21589 Reaches CISA's Exploited List After a Public Exploit

CISA added CVE-2026-21589, a 9.3-rated file-read flaw in eight self-hosted Atlassian products, to its exploited-vulnerabilities catalog on Oct. 15 with an Oct. 18 deadline. An unauthenticated attacker needs only the exact path of a file in the web root.

Atlassian's advisory, released Oct. 5, covers the Data Center editions of Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo and Crowd, plus Crucible and Fisheye. Atlassian Cloud has been patched, and Atlassian says it found no evidence of exploitation there. The advisory says Atlassian cannot determine whether individual customer instances have been compromised.

What the 9.3 score measures

The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H. The score overstates the direct damage: on the vulnerable product itself the impact is confidentiality only, with no integrity or availability effect. The 9.3 comes from the three subsequent-system metrics, all rated high, which reflect what a stolen file can unlock elsewhere.

Atlassian says directory listing is not possible and the attacker must know the exact file name and path. It does not say which files are reachable beyond "files within the web application root directory".

How a file read becomes an administrator

BleepingComputer reported that watchTowr, an offensive security firm, published a technical report, a proof of concept and a scanner after the advisory. The root cause is a shared web-resource library that converts a double colon into a forward slash, which lets an attacker build traversal requests through plugin resource endpoints. watchTowr confirmed file reads in Jira, Confluence and Bitbucket, and its technique could not escape the Tomcat application context.

For deployments integrated with Crowd, watchTowr showed a longer chain. The attacker reads WEB-INF/classes/crowd.properties, which holds plaintext application credentials, then uses them against Crowd's API to create a Jira administrator account. The same credentials give administrator access to Crowd. That needs Crowd to be reachable, and watchTowr says an IP allowlist makes the chain much harder.

Timeline from advisory to the KEV deadline

• Oct. 5: Atlassian releases the advisory.
• Oct. 5 to 7: watchTowr publishes its report and proof of concept.
• Oct. 7: BleepingComputer reports exploitation attempts on a Previdian honeypot network. Ryan Dewhurst, a Previdian researcher, told BleepingComputer attempts began "within two hours" of watchTowr's publication.
• Oct. 15: CISA adds CVE-2026-21589 to the KEV catalog.
• Oct. 18: federal agency deadline.

The exploitation evidence is honeypot traffic, not confirmed compromises. BleepingComputer's report gives no victim count and no count of exposed instances, and it does not say whether the Crowd chain has been used in the wild.

Fixed versions, by product

Product	Fixed versions
Bitbucket	9.4.26, 10.2.8, 10.5.1
Confluence	9.2.26, 10.2.19
Jira Service Management	5.12.40, 10.3.26, 11.3.12
Jira Software	9.12.40, 10.3.26, 11.3.12
Bamboo	10.2.24, 12.1.12
Crowd	6.3.7, 7.0.3, 7.1.7, 7.2.4
Crucible and Fisheye	4.9.15

Atlassian says binary patches are no longer released and critical fixes are backported to maintenance releases, so the table lists the fixed releases to move to.

What to do before the patch lands

Atlassian's first instruction is to take the instance off the internet if possible; instances that require login should also be restricted. If patching has to wait, it gives three mitigations: a WAF or proxy rule that blocks .. next to /, \ or ::, including URL-encoded forms; a Tomcat RewriteValve with a rewrite.config for Confluence, Jira, Bamboo and Crowd; or a urlrewrite.xml rule returning 404 for Bitbucket. Each needs a restart.

To check for past use, URL-decode access log request lines up to two passes and search for the same patterns. The three-day KEV deadline matches the Fortinet entry CISA added Oct. 16, and CISA's BOD 26-04 shortened the clock.