CVE-2026-21589: This: Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauth

Hackers exploit critical Atlassian flaw after public PoC release

Attackers began exploiting critical Atlassian flaw CVE-2026-21589 within hours of a public proof of concept.

Attackers are exploiting CVE-2026-21589, a critical unauthenticated arbitrary file-access flaw in self-hosted Atlassian products including Jira, Confluence, Bitbucket, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Previdian observed honeypot exploitation within two hours of watchTowr publishing a proof of concept, from three source addresses. In some Crowd-integrated deployments, reading WEB-INF/classes/crowd.properties can expose credentials used to create a Jira administrator. A Nuclei template is available, and Atlassian urges immediate patching or WAF and rewrite mitigations.

BleepingComputerOct 7, 12:49 UTC · 1d agoExploit / PoC in the wildCVE-2026-215891· 1 read

Atlassian Vulnerability Comes Under Attack Hours After Details Go Public

Attackers are exploiting critical Atlassian flaw CVE-2026-21589 to read sensitive files on Data Center products.

Attackers are exploiting CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-read flaw in Atlassian Data Center products including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. watchTowr Labs found that double-colon sequences are treated as path separators, allowing reads of webroot files; in one Crowd deployment, crowd.properties credentials were used to create a Jira administrator. Previdian reported 15 attempts from three IP addresses in Japan and the United States, and honeypot exploitation started about two hours after the analysis. Fixed builds include Bitbucket 9.4.26, 10.2.8 and 10.5.1, Confluence 9.2.26 and 10.2.19, plus listed Jira, Bamboo, Crowd, Crucible, and Fisheye releases.

Security Affairs07:26 UTC · 12h agoExploit / PoC in the wildCVE-2026-215891

Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)

Attackers are probing Atlassian Data Center products for critical file-read flaw CVE-2026-21589 one day after patches.

One day after Atlassian patched CVE-2026-21589, a critical arbitrary file-access flaw in self-managed Data Center products, Previdian reported exploitation attempts against its honeypots. watchTowr traced the bug to atlassian-plugins-webresource, where double colons are converted to slashes and bypass path filters, allowing reads of files such as WEB-INF/web.xml. On Crowd, crowd.properties can expose plaintext application credentials that let an attacker list users, create accounts, and add them to groups such as jira-administrators. Affected products include Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye; Atlassian urges upgrades or isolating instances from the internet.

Help Net SecurityOct 7, 14:21 UTC · 1d agoExploit / PoC in the wildCVE-2026-21589

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)

Atlassian patched CVE-2026-21589, a pre-auth arbitrary file read affecting Jira, Confluence, Bitbucket, and other Data Center products.

On October 5, 2026, Atlassian issued an out-of-band advisory for CVE-2026-21589, which it called arbitrary file access and watchTowr assessed as a pre-authentication arbitrary file read. The flaw affects prior versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center, with fixes in current supported branches. watchTowr traced it to a shared web-resource plugin library and cited roughly 700,000 internet-facing Confluence instances. The research is framed as exposure validation ahead of in-the-wild exploitation; none is reported.

watchTowr LabsOct 6, 17:01 UTC · 2d agoVulnerability CVE-2026-215896· 3 reads

Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

Unauthenticated Atlassian Data Center flaw CVE-2026-21589 saw exploitation attempts within two hours.

Atlassian disclosed CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-access flaw in Data Center editions of Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. An attacker who already knows an exact path can read files under the web root; on Crowd and Jira that can include crowd.properties and lead to administrative access. Previdian reported 15 honeypot attempts from three IP addresses in Japan and the United States, starting about two hours after watchTowr published technical details. Atlassian says Cloud is patched, fixed Data Center builds are available, and temporary options include removing instances from the internet or applying WAF and rewrite rules.

The Hacker NewsOct 7, 11:49 UTC · 1d agoExploit / PoC in the wildCVE-2026-215892· 1 read

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Atlassian patched CVE-2026-21589, an unauthenticated file-read flaw in eight products, with public proof-of-concept code available.

On October 5, 2026, Atlassian disclosed CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-access flaw affecting Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. watchTowr found double-colon sequences become path separators during web-resource handling, allowing reads throughout the application web root but not outside the Tomcat context. A public Python file-read proof-of-concept and Nuclei template are available. Cloud products are already patched; on-premises customers should upgrade to the listed fixed versions, treat WAF rules as temporary, and search access logs for encoded traversal.

Rapid7 BlogOct 7, 12:11 UTC · 1d agoVulnerability CVE-2026-215891

Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication

Attackers probed critical Atlassian CVE-2026-21589 within hours of a public PoC, with 190 honeypot attempts.

Atlassian disclosed CVE-2026-21589 on October 5, rating the self-hosted Data Center flaw CVSS 9.3 across Bitbucket, Confluence, Jira, Bamboo, Crowd, and related products. A remote unauthenticated attacker who knows an exact path can read files in the web root; WatchTowr showed that Crowd integration can expose plaintext credentials used to create a Jira administrator. Previdian honeypots recorded exploitation attempts starting October 6, reaching 190 attempts from 32 IP addresses by October 8. Patches are available, and CISA has not yet added the bug to the KEV catalog.

SecurityWeek14:04 UTC · 5h agoExploit / PoC in the wildCVE-2026-21589

Critical Flaw in Multiple Atlassian Products Exploited in the Wild

Unauthenticated Atlassian flaw CVE-2026-21589 is exploited in the wild to read Data Center application files.

Atlassian disclosed CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-read flaw affecting eight self-managed Data Center products, including Jira, Confluence, Bitbucket, Bamboo, and Crowd. WatchTowr traced it to path-handling in the shared atlassian-plugins-webresource library, which can expose webroot files such as crowd.properties and the credentials used to reach Crowd, potentially enabling user or privilege changes. On October 7, VulnCheck added the flaw to its known-exploited list after activity targeting Bamboo Data Center; it was not in CISA’s KEV catalog at publication. Atlassian listed fixed versions and temporary WAF or rewrite mitigations and said it cannot confirm whether instances were compromised.

Infosecurity Magazine10:05 UTC · 9h agoExploit / PoC in the wildCVE-2026-215891

Atlassian’s critical flaw turns eight enterprise products into one big security problem

Unauthenticated CVE-2026-21589 lets attackers read web-root files on eight Atlassian Data Center products; exploitation is unconfirmed.

Atlassian disclosed CVE-2026-21589, a critical CVSS 9.3 arbitrary file access flaw in its Data Center software. Unauthenticated attackers who already know an exact file name and path can read files in the web application root and, using path traversal, potentially reach files outside it; directory listing is not possible. All versions of Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Service Management, and Jira Software Data Center are affected. Atlassian says its cloud offerings are patched and it has not found evidence of exploitation, and it urges customers to upgrade or immediately remove exposed instances from the internet.

CSO OnlineOct 7, 01:51 UTC · 1d agoVulnerability CVE-2026-215891

Atlassian Patches Critical Vulnerability Affecting 8 Products

Atlassian patched unauthenticated file-read flaw CVE-2026-21589 in eight products, and no exploitation has been observed.

Atlassian patched CVE-2026-21589, a critical arbitrary file access flaw with a CVSS score of 9.3. Unauthenticated attackers who already know an exact path can read specific files in the web root but cannot enumerate directories. All versions of Bitbucket, Bamboo, Crowd, Crucible, Confluence, Fisheye, Jira Service Management, and Jira Software Data Center are affected, with fixes in multiple current branches. Atlassian and WatchTowr say exploitation has not been observed, though Crowd deployments may store SSO credentials in plaintext at a predictable path.

SecurityWeekOct 7, 06:37 UTC · 1d agoVulnerability CVE-2026-21589

Atlassian urges immediate patching of critical Data Center file access vulnerability (CVE-2026-21589)

Atlassian warns unauthenticated attackers can read files on Data Center products via critical CVE-2026-21589.

Atlassian disclosed CVE-2026-21589, a critical arbitrary file access flaw scored 9.3 under CVSS 4.0, affecting all versions of its Data Center products including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye. An unauthenticated attacker who knows an exact file name and path can read files under the web application root, but cannot enumerate directories. Cloud products are patched and Atlassian reported no evidence of exploitation; it urges Data Center customers to upgrade to fixed releases or take instances off the internet.

Help Net SecurityOct 6, 12:26 UTC · 2d agoVulnerability CVE-2026-215892

Atlassian Patches Critical Vulnerabilities in Jira, Confluence, Bitbucket, and Five More Products

Atlassian patched CVE-2026-21589, a CVSS 9.3 unauthenticated file-access flaw in eight Data Center products.

Atlassian disclosed CVE-2026-21589, a critical arbitrary file-access flaw rated CVSS 9.3, affecting eight Data Center products including Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Unauthenticated attackers who know an exact file name and path can read files in the application web root, but cannot list directories. Fixed releases are available for each product, and Atlassian Cloud is already patched. The vendor reports no evidence of exploitation and offers temporary WAF or Tomcat RewriteValve mitigations until upgrades are applied.

Cyber Security NewsOct 6, 08:18 UTC · 2d agoVulnerability CVE-2026-215891

Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

CVE-2026-21589 lets unauthenticated attackers read known files in eight self-hosted Atlassian Data Center products.

Atlassian disclosed CVE-2026-21589 on October 5, a CVSS 9.3 path traversal in eight customer-hosted Data Center products. An unauthenticated attacker who already knows an exact filename and path can read files in the web-application root but cannot list the directory. Fixed builds include Confluence 9.2.26 and 10.2.19, Jira Software 9.12.40, 10.3.26, and 11.3.12, plus updates for Jira Service Management, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Cloud is patched with no evidence of exploitation; self-hosted impact is unconfirmed, temporary URL blocks are not a patch substitute, and the CVE record conflicts with some advisory fix versions, while prior Jira traversal CVE-2021-26086 is in CISA's KEV catalog.

The Hacker NewsOct 6, 06:58 UTC · 2d agoVulnerability CVE-2026-21589 CVE-2021-26086

Atlassian warns of critical file access flaw in its datacenter products

Atlassian urges patches for CVE-2026-21589, an unauthenticated file-read flaw in eight Data Center products.

Atlassian emailed customers an “Action required” notice for CVE-2026-21589, a CVSS 9.3 arbitrary file-access flaw in Data Center editions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. An unauthenticated attacker who knows an exact filename and path can read specific files under the web application root; directory listing is not possible, but some configurations may hold sensitive files. Patched versions are available, and Atlassian Cloud is already fixed. Customers who cannot upgrade immediately are told to remove internet-exposed instances from external access.

The Register · SecurityOct 6, 04:20 UTC · 2d agoVulnerability CVE-2026-215891

Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)

Attackers are scanning Atlassian products for CVE-2026-21589, a traversal bug that can read web files.

On October 5, Atlassian patched CVE-2026-21589, an arbitrary file-access flaw in which slash characters encoded as "::" can be turned back into a directory traversal. Access is limited to the web application directory; proof-of-concept requests target files such as WEB-INF/web.xml on Jira, Bitbucket, and Confluence. The SANS Internet Storm Center said honeypots received matching exploit attempts starting October 6 using URLs from a Watchtowr write-up. Every observed source address was hosted at DigitalOcean, which the author believes indicates a single actor.

SANS Internet Storm CenterOct 7, 14:59 UTC · 1d agoExploit / PoC in the wildCVE-2026-21589

PoC Exploit Released for Critical Atlassian Flaw That Can Lead to Jira Admin Access

watchTowr released a detection PoC for unauthenticated Atlassian file-read CVE-2026-21589 that can yield Jira admin access.

watchTowr published a detection proof of concept for CVE-2026-21589, a critical unauthenticated arbitrary file-read flaw in multiple self-managed Atlassian Data Center products. Shared web-resource handling converts double colons into slashes, enabling directory traversal to files under the application webroot, including WEB-INF. If Jira is integrated with Crowd, crowd.properties can expose application credentials that may allow creation of a jira-administrators account. Atlassian issued fixes on October 5, including Jira Software 9.12.40, 10.3.26, and 11.3.12; in-the-wild exploitation is not reported.

Cyber Security NewsOct 7, 13:30 UTC · 1d agoExploit / PoC CVE-2026-21589

Atlassian CVE-2026-21589 Flaw Exposes Files in Jira and Confluence Data Center

Atlassian CVE-2026-21589 lets unauthenticated attackers read known files in Jira and Confluence Data Center.

Atlassian disclosed CVE-2026-21589, a critical path-traversal flaw scored CVSS 9.3, in Jira Software Data Center and Confluence Data Center. Unauthenticated attackers who already know an exact filename and path can read files under the web root; the bug does not list directories, and Atlassian does not describe file modification or code execution. Fixes are in Jira 9.12.40, 10.3.26, and 11.3.12, and Confluence 9.2.26 and 10.2.19. Cloud is already patched with no evidence of exploitation; Data Center admins who cannot patch should remove instances from the internet and apply limited WAF or Tomcat RewriteValve blocks.

GBHackersOct 6, 07:29 UTC · 2d agoVulnerability CVE-2026-215892

CVE-2026-21589 | Atlassian Data Center Products Unauthenticated Arbitrary File Read Vulnerability

Atlassian Data Center products have critical unauthenticated file-read flaw CVE-2026-21589, with no known exploitation.

CVE-2026-21589 lets unauthenticated remote attackers read specific files in the web root of affected Atlassian Data Center products if they know the exact path. Directory listing is not possible. Atlassian rates it critical, says Cloud products are patched, and reports no evidence of exploitation. Fixed releases include Bitbucket 9.4.26, 10.2.8 and 10.5.1, Confluence 9.2.26 and 10.2.19, plus updates for Jira, Bamboo, Crowd, Crucible, and Fisheye. Horizon3 released a NodeZero test to check exposure.

Horizon3.aiOct 6, 23:15 UTC · 1d agoVulnerability CVE-2026-215891

Atlassian warns of critical file-access flaw in Jira, Confluence

Atlassian warns CVE-2026-21589 allows unauthenticated file access in self-hosted Jira, Confluence, Bitbucket, and other Data Center products.

Atlassian disclosed CVE-2026-21589, a critical arbitrary file-access flaw in several self-hosted Data Center products. An unauthenticated attacker who knows a file's exact name and path can read specific files in the web root but cannot list directories. Fixes include Confluence 9.2.26 and 10.2.19, Jira Software 9.12.40, 10.3.26, and 11.3.12, plus updates for Bitbucket, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Cloud instances were patched automatically, and Atlassian says it has no evidence of exploitation.

BleepingComputerOct 6, 17:34 UTC · 2d agoVulnerability CVE-2026-21589

2026-015: Critical Vulnerability in Multiple Atlassian Products

Release Date: 07-10-2026 07:52:48 History: 06/10/2026 --- v1.0 -- Initial publication Summary On 5 October 2026, Atlassian published a security advisory addressing a critical arbitrary file access vulnerability. It affects Bitbucket Data Center , Confluence Data Center , Jira Service Management Data Center , Jira Software Data Center , Bamboo Data Center , Crowd Data Center , Crucible and Fisheye…

CERT-EU AdvisoriesJun 10, 00:00 UTC · Jun 10, 2026Vulnerability CVE-2026-21589

CVE-2026-21589

In the news20 stories

References9