Bamboo (Product): news timeline & CVEs

Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication

Attackers probed critical Atlassian CVE-2026-21589 within hours of a public PoC, with 190 honeypot attempts.

Atlassian disclosed CVE-2026-21589 on October 5, rating the self-hosted Data Center flaw CVSS 9.3 across Bitbucket, Confluence, Jira, Bamboo, Crowd, and related products. A remote unauthenticated attacker who knows an exact path can read files in the web root; WatchTowr showed that Crowd integration can expose plaintext credentials used to create a Jira administrator. Previdian honeypots recorded exploitation attempts starting October 6, reaching 190 attempts from 32 IP addresses by October 8. Patches are available, and CISA has not yet added the bug to the KEV catalog.

SecurityWeek14:04 UTC · 6h agoExploit / PoC in the wild 21 sources CVE-2026-21589

PoC Exploit Released for Critical Atlassian Flaw That Can Lead to Jira Admin Access

watchTowr released a detection PoC for unauthenticated Atlassian file-read CVE-2026-21589 that can yield Jira admin access.

watchTowr published a detection proof of concept for CVE-2026-21589, a critical unauthenticated arbitrary file-read flaw in multiple self-managed Atlassian Data Center products. Shared web-resource handling converts double colons into slashes, enabling directory traversal to files under the application webroot, including WEB-INF. If Jira is integrated with Crowd, crowd.properties can expose application credentials that may allow creation of a jira-administrators account. Atlassian issued fixes on October 5, including Jira Software 9.12.40, 10.3.26, and 11.3.12; in-the-wild exploitation is not reported.

Cyber Security Newsupdated 14:04 UTC · 6h agofirst Oct 7, 13:30 UTC · 1d agoExploit / PoC 21 sources CVE-2026-21589

Hackers exploit critical Atlassian flaw after public PoC release

Attackers began exploiting critical Atlassian flaw CVE-2026-21589 within hours of a public proof of concept.

Attackers are exploiting CVE-2026-21589, a critical unauthenticated arbitrary file-access flaw in self-hosted Atlassian products including Jira, Confluence, Bitbucket, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Previdian observed honeypot exploitation within two hours of watchTowr publishing a proof of concept, from three source addresses. In some Crowd-integrated deployments, reading WEB-INF/classes/crowd.properties can expose credentials used to create a Jira administrator. A Nuclei template is available, and Atlassian urges immediate patching or WAF and rewrite mitigations.

BleepingComputerupdated 14:04 UTC · 6h agofirst Oct 7, 12:49 UTC · 1d agoExploit / PoC in the wild 21 sources CVE-2026-21589

Atlassian security advisory (AV26-1002)

Canada's Cyber Centre warns Atlassian server products are affected by arbitrary file access CVE-2026-21589.

The Canadian Centre for Cyber Security issued advisory AV26-1002 on October 5, 2026, for Atlassian arbitrary file access vulnerability CVE-2026-21589. Affected products include specified Data Center and Server versions of Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Service Management, and Jira Software, with all Server versions listed for several products. The Cyber Centre told administrators to review Atlassian's advisories and apply updates as they become available. The bulletin does not report that the flaw is being exploited.

Canadian Centre for Cyber Securityupdated 14:04 UTC · 6h agofirst Oct 6, 13:44 UTC · 2d agoAdvisory 21 sources CVE-2026-215891

Atlassian warns of critical file access flaw in its datacenter products

Atlassian urges patches for CVE-2026-21589, an unauthenticated file-read flaw in eight Data Center products.

Atlassian emailed customers an “Action required” notice for CVE-2026-21589, a CVSS 9.3 arbitrary file-access flaw in Data Center editions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. An unauthenticated attacker who knows an exact filename and path can read specific files under the web application root; directory listing is not possible, but some configurations may hold sensitive files. Patched versions are available, and Atlassian Cloud is already fixed. Customers who cannot upgrade immediately are told to remove internet-exposed instances from external access.

The Register · Securityupdated 14:04 UTC · 6h agofirst Oct 6, 04:20 UTC · 2d agoVulnerability 21 sources CVE-2026-215891

Bamboo

Timeline5 articles

Related CVEsby mentions

Appears with

Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication

PoC Exploit Released for Critical Atlassian Flaw That Can Lead to Jira Admin Access

Hackers exploit critical Atlassian flaw after public PoC release

Atlassian security advisory (AV26-1002)

Atlassian warns of critical file access flaw in its datacenter products