Atlassian CVE-2026-21589 Probed Within Two Hours of Public Exploit

Attackers began probing CVE-2026-21589, an unauthenticated file-read flaw in eight self-hosted Atlassian Data Center products, within about two hours of watchTowr publishing a proof of concept, according to Previdian, a security firm that runs honeypots. Atlassian rated the flaw 9.3 on the CVSS 4.0 severity scale and said when it disclosed the flaw on Oct. 5 that it had no evidence of exploitation.

BleepingComputer reported the honeypot activity on Oct. 7. Atlassian's cloud products were patched before disclosure and need no action, Help Net Security reported, citing the advisory.

What an attacker needs

The flaw lets an unauthenticated attacker read specific files in an application's web root, provided the attacker knows the exact file name and path. Atlassian said it does not allow directory listing. In BleepingComputer's account, the root cause is a shared web-resource library that converts a double colon ("::") into a forward slash, which lets a request slip past traversal checks on plugin resource endpoints.

Affected are Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye. Help Net Security says all versions before the fixes are affected.

Where the score understates the risk

A file read that needs a known path sounds contained. The watchTowr chain shows why 9.3 is defensible. On Jira installations integrated with Crowd, the file WEB-INF/classes/crowd.properties holds the application's credentials in plaintext. Reading it lets an attacker call Crowd's API and create a Jira administrator account.

That chain has preconditions. Crowd must be reachable from the attacker and the application account must have enough permissions. watchTowr's technique could not traverse outside the Tomcat application context, and an IP allowlist on Crowd would make the attack considerably harder, since the attacker would need to pivot through another machine.

Timeline

Date	Event
Oct. 5	Atlassian publishes the advisory and fixed versions
Oct. 6	BleepingComputer and Help Net Security report it; Atlassian says no known exploitation
Oct. 7	Previdian sees attempts from three IP addresses within two hours of watchTowr's report and proof of concept

Ryan Dewhurst of Previdian told BleepingComputer that exploitation attempts began "within two hours of watchTowr publishing its technical research" and that he expects activity to rise over the coming days and weeks. A Nuclei scanning template is public, which lowers the cost of mass scanning. Previdian listed 38.60.157[.]86, 146.70.187[.]234 and 159.26.119[.]225 as the source addresses it saw.

Fixed versions

The lowest fixed release on each supported branch, per Help Net Security and BleepingComputer, is below. Several products have more than one.

Product	Fixed versions
Confluence Data Center	9.2.26, 10.2.19
Jira Software Data Center	9.12.40, 10.3.26, 11.3.12
Bitbucket Data Center	9.4.26, 10.2.8, 10.5.1
Crowd Data Center	6.3.7, 7.0.3, 7.1.7, 7.2.4

Jira Service Management also has 5.12.40, 10.3.26 and 11.3.12. Bamboo has 10.2.24 and 12.1.12. Crucible and Fisheye both have 4.9.15.

What to do if you cannot patch today

Atlassian told administrators to take internet-facing instances out of public reach, including those that require a login. It published three temporary mitigations: a WAF or proxy rule blocking the traversal patterns, Tomcat RewriteValve rules for Confluence, Jira Service Management, Jira, Bamboo and Crowd, or a URL rewrite rule for Bitbucket. Changes have to cover every cluster node, including Bitbucket mirror farm nodes.

Atlassian said it cannot tell whether any customer instance has been compromised, so access logs should be searched for the traversal patterns in its bulletin. Anyone whose Jira is wired to Crowd should check whether crowd.properties was served to anyone, because it holds the Crowd application password in plaintext.

Other patching coverage on this site includes CVE-2026-97229 in GitLab and the Android phone number verification change.