Attackers are exploiting CVE-2026-21589, an unauthenticated file-read vulnerability in Atlassian's self-hosted Data Center products. On October 15, the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Atlassian disclosed the flaw on October 5 and rates it CVSS 9.3. Eight products are affected: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye. Atlassian's cloud service has already been patched, so the remaining risk is on customer-run servers.

Atlassian initially reported no evidence of exploitation. That changed soon after security firm watchTowr published its research and a proof of concept on October 6. Atlassian's advisory says the company cannot determine whether individual customer instances have been compromised. That means each organization running an affected product has to check its own systems.

What the Flaw Allows

eSecurity Planet's summary of the advisory says the bug lets an unauthenticated remote attacker read files in an application's web root, as long as the attacker knows the exact file name and path. The flaw does not allow directory listing, so an attacker cannot browse to find files. They need to know or guess where useful files are. According to BleepingComputer, watchTowr confirmed file reads in Jira, Confluence and Bitbucket but could not reach files outside the Tomcat application context.

That limitation does not help much in practice. Atlassian's products are widely deployed, and their file layouts are well documented. watchTowr's research, as reported by BleepingComputer, showed one serious outcome. In Jira deployments integrated with Atlassian Crowd, a configuration file in the web root stores the Crowd application credentials, including a plaintext password. watchTowr said that if Crowd is reachable and the application has sufficient permissions, those credentials can be used to create a Jira administrator account. That turns a file-read bug into full administrative control of the Jira instance.

watchTowr also said an IP allowlist on Crowd would make this path to admin access "significantly more difficult." Organizations that already limit which hosts can talk to Crowd are better protected against the most damaging version of the attack. They still need to patch.

CISA's catalog entry lists the issue as an Atlassian Multiple Products "Files or Directories Accessible to External Parties" vulnerability. As of October 19, the National Vulnerability Database (NVD) shows the CVE-2026-21589 record with a status of "Rejected" and no CVSS metrics, but the KEV listing is still in place. Defenders should track this issue by Atlassian's advisory and the KEV entry, not by NVD lookups alone.

Timeline

  • October 5: Atlassian publishes its advisory for CVE-2026-21589 (CVSS 9.3) covering eight Data Center products. The advisory says Atlassian cannot determine whether individual customer instances were compromised.
  • October 6: watchTowr publishes technical research and a proof of concept, including the Crowd-integrated Jira path to admin access. It also releases a free scanner to help administrators check their exposure.
  • Within two hours of the watchTowr post: Previdian's honeypots record exploitation attempts, according to BleepingComputer.
  • October 7: CrowdSec logs its first exploitation attempt. BleepingComputer reports that a Nuclei scanning template is now public.
  • October 9: CrowdSec's signal count peaks at 2,021, most of it from LeakIX, a research scanner.
  • October 12: CrowdSec publishes its tracking report: 6,657 signals between October 7 and 11.
  • October 15: CISA adds CVE-2026-21589 to the KEV catalog, with a remediation due date of October 18 for federal civilian agencies.

Who Is Probing, and Where

CrowdSec recorded 6,657 matching requests between October 7 and 11, but 88% came from LeakIX, a research scanner. The remaining 43 addresses, including 24 that probed only this CVE, are the activity that matters. Of the 109 addresses CrowdSec's threat intelligence links to the CVE over 30 days, 69 had also probed CVE-2021-26086, an older Atlassian path-traversal bug.

Among targeted organizations in CrowdSec's data, Germany accounted for 35 percent, France for 15 percent, the US for 11 percent and South Africa for 8 percent — figures that reflect where CrowdSec has sensors, not where Atlassian is deployed. CrowdSec also cited watchTowr's count of just under 700,000 internet-visible Confluence instances. That figure covers only one of the eight affected products.

Ryan Dewhurst of Previdian told BleepingComputer that a Nuclei template has now been released, which makes automated scanning easier. He expects exploitation to increase significantly over the coming days and weeks. With a public proof of concept and a scanning template both available, defenders should assume that any internet-facing, unpatched instance has already been probed.

Fixed Versions

Atlassian has released fixes for every affected product line, and says all versions released before these fixes are vulnerable. According to eSecurity Planet's summary of the advisory, the fixed releases are:

  • Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1
  • Confluence Data Center: 9.2.26, 10.2.19
  • Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12
  • Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12
  • Bamboo Data Center: 10.2.24, 12.1.12
  • Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4
  • Crucible: 4.9.15
  • Fisheye: 4.9.15

Administrators should confirm the exact fixed release for their version branch in Atlassian's advisory before upgrading.

What It Means for Defenders

Because exploitation started within hours of the proof of concept and Atlassian cannot tell customers whether they were compromised, organizations should treat both patching and investigation as urgent.

  • Patch every affected product, not only Jira and Confluence. Upgrade to the fixed release for your branch listed above. Bamboo, Crowd, Crucible and Fisheye often get less attention than Jira and Confluence, but all eight products are affected.
  • Note that the KEV deadline has already passed. CISA added CVE-2026-21589 to the catalog on October 15 with a due date of October 18, a three-day window. Federal civilian agencies that have not remediated are already past the deadline. Other organizations should treat the listing as confirmation that the flaw is being actively exploited.
  • If you cannot patch right away, block exploitation at the edge. Atlassian's temporary mitigations include restricting external network access, filtering at a web application firewall or proxy, and applying Tomcat RewriteValve rules (or a URL rewrite rule for Bitbucket) to block the vulnerable request patterns. Take vulnerable instances off the public internet where you can.
  • Rotate Crowd credentials in integrated deployments. If Jira was connected to Crowd and was reachable while unpatched, assume the Crowd application password may have been read. Rotate it and any other secrets stored in files under the web root.
  • Audit administrator accounts. Because watchTowr showed that exposed Crowd credentials can be used to create a Jira admin, review the admin list for accounts created on or after October 5 and verify each one.
  • Review access logs. eSecurity Planet advises administrators to review access logs for the request patterns described in Atlassian's advisory. Pay particular attention to unauthenticated requests for configuration files from October 6 onward, and cross-check source IPs against threat-intelligence feeds that track this CVE.
  • Re-verify your patch status. Public scanning templates make it easy for attackers to recheck instances later. Confirm that fixes were applied to every node, including staging and disaster-recovery systems.

Customers on Atlassian Cloud do not need to take action for this vulnerability, because Atlassian has already patched its hosted service.

Sources