Two hours after the write-up

Atlassian published an advisory on Monday 5 October for CVE-2026-21589, an arbitrary file access flaw in eight self-managed products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye. It rated the flaw critical, 9.3 under CVSS version 4. An unauthenticated attacker can read specific files inside the web application's root directory, provided they know each file's exact name and path; the flaw cannot list directories. "In some configurations, there may be sensitive files present that increase your risk," the advisory says. Atlassian's cloud products have been patched, and the company says it found no evidence of exploitation there.

On Tuesday the security firm watchTowr published an analysis built by comparing vulnerable and patched packages. According to Help Net Security, the fault sits in a web-resource library the products share, which turns double colons into forward slashes, so a traversal sequence written with colons slips past the checks on slashes. The researchers read protected files in Jira, Confluence and Bitbucket, though not outside the Tomcat application context, Rapid7 says.

The sensitive file the advisory hinted at turned out to be Crowd's. Where Jira is connected to Atlassian Crowd, the identity and single sign-on product, a file called crowd.properties holds an application name and password in plain text. With those, watchTowr showed, an attacker who can reach Crowd can create a user and add it to the jira-administrators group. An allowlist of IP addresses on Crowd blocks that direct route, the researchers noted; an attacker would then have to pivot through other machines, or use request-forgery features of the Atlassian products themselves, to reach Crowd, according to BleepingComputer.

Attackers did not wait. Previdian, a threat intelligence firm, says on its tracking page that its honeypots first recorded exploitation attempts on 6 October. "Within two hours of public exploit details becoming available, we were already seeing exploitation attempts hit our honeypot network," Ryan Dewhurst, its founder and chief executive, said in a statement reported by The Hacker News, which reported, citing Previdian's telemetry, 15 attempts from three IP addresses in Japan and the US. "The release of a Nuclei template will make mass automated scanning even easier, so we expect activity around CVE-2026-21589 to increase quickly." As of Wednesday afternoon, US time, the flaw was not in CISA's catalogue of known exploited vulnerabilities, which was last updated on 4 October.

What exactly is public is described differently. watchTowr released a script on GitHub that checks whether a Jira, Confluence or Bitbucket instance is vulnerable; Rapid7 describes the public artefacts as a Python file-read proof of concept and a Nuclei template. Help Net Security reports that watchTowr built an exploit but did not publish it. The Previdian attempts show that the published detail was enough to start probing.

Every version before the fixes is affected, including unsupported ones. The fixed releases are Bitbucket 9.4.26, 10.2.8 and 10.5.1; Confluence 9.2.26 and 10.2.19; Jira Software 9.12.40, 10.3.26 and 11.3.12; Jira Service Management 5.12.40, 10.3.26 and 11.3.12; Bamboo 10.2.24 and 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7 and 7.2.4; and Crucible and Fisheye 4.9.15. Atlassian tells customers who cannot patch to take instances off the internet, and offers a firewall or proxy rule, a Tomcat RewriteValve rule for most products and a separate rewrite rule for Bitbucket. Rapid7 calls those limited and no replacement for patching, which it says should happen on an emergency basis, outside normal patch cycles.

Patching does not settle whether files have already been read. Atlassian says it cannot tell whether an individual customer's instance was compromised, and asks administrators to URL-decode each access-log request line up to twice and search for two dots next to a slash, a backslash or a double colon. Rapid7 advises rotating credentials and other secrets if that search shows protected configuration files were reached. For Crowd-connected sites, the obvious candidate is the password in crowd.properties.