Atlassian's CVE-2026-21589 Draws Exploit Attempts Two Hours After watchTowr Publishes

An unauthenticated attacker who can reach a self-hosted Atlassian Data Center product and knows the exact path of a file in its web root can read that file, and on Jira installs backed by Crowd that read can end in an administrator account. Atlassian disclosed the flaw, CVE-2026-21589 (CVSS 9.3), on Monday, Oct. 5, and fixed builds exist for eight products.

The patch is the only complete answer. Atlassian's temporary measures are to take the instance off the public internet, add a WAF rule, or block the traversal pattern with a Tomcat RewriteValve (Confluence, Jira, Jira Service Management, Bamboo, Crowd) or an urlrewrite.xml rule (Bitbucket).

Fixed versions for CVE-2026-21589

Atlassian says its cloud products are already patched. The Data Center and server-side fixes, as listed by The Hacker News, are:

Product	Fixed in
Bitbucket Data Center	9.4.26, 10.2.8, 10.5.1
Confluence Data Center	9.2.26, 10.2.19
Jira Software Data Center	9.12.40, 10.3.26, 11.3.12
Jira Service Management Data Center	5.12.40, 10.3.26, 11.3.12
Bamboo Data Center	10.2.24, 12.1.12
Crowd Data Center	6.3.7, 7.0.3, 7.1.7, 7.2.4
Crucible and Fisheye	4.9.15

How a double colon becomes a directory traversal

The root cause sits in a web-resource library shared across the products. It turns a double colon (::) into a forward slash, so a request containing ..::..::..::..::WEB-INF::web.xml is read as a traversal path. Attackers reach it through plugin resource endpoints; the researchers' example uses a trailing slash on a colorpicker plugin resource to get to WEB-INF/web.xml.

The score overstates the risk for most installs and understates it for one configuration. Directory listing is not possible, the attacker has to guess the file name, and BleepingComputer reports that watchTowr could not traverse outside the Tomcat application context. On Jira and Crowd, though, WEB-INF/classes/crowd.properties holds Crowd credentials in plaintext. With those, an attacker can create users through Crowd's API and promote a rogue account to Jira Administrator. The same credentials grant administrator access to Crowd. Exploitation needs Crowd to be reachable, so restricting the IP addresses allowed to talk to it makes the chain harder.

Two hours from write-up to exploitation attempts

watchTowr published a technical report and a proof-of-concept repository after Atlassian's advisory, along with a free scanner. A Nuclei template followed, which makes automated scanning easier.

Ryan Dewhurst, founder and CEO of Previdian, told BleepingComputer that his honeypots began recording attempts within two hours of watchTowr's publication. Previdian counted 15 attempts from three IP addresses in Japan and the United States: 38.60.157[.]86, 146.70.187[.]234 and 159.26.119[.]225.

Jake Knott, head of threat intelligence at watchTowr, later confirmed exploitation in the wild, mostly fingerprinting and sweeps for common configuration and sensitive files. watchTowr had not seen post-compromise activity or stolen credentials being used. Atlassian said it "cannot determine whether individual customer instances have been compromised."

What to check on an unpatched instance

Block the three Previdian addresses, then search web-server access logs for request paths containing ::. If a Jira instance authenticates against Crowd and was reachable from the internet, rotate the Crowd application password and audit recent administrator creations before assuming the patch closes the matter. Related reporting on this site covers Cisco's Secure Email Gateway flaw and the Zammad zero-days on CISA's list.Dewhurst expects Atlassian exploitation to rise over the days and weeks after Oct. 7. None of the sources fetched for this report say CISA has added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog.