Bamboo Data Center (Product): news timeline & CVEs

Critical Flaw in Multiple Atlassian Products Exploited in the Wild

Unauthenticated Atlassian flaw CVE-2026-21589 is exploited in the wild to read Data Center application files.

Atlassian disclosed CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-read flaw affecting eight self-managed Data Center products, including Jira, Confluence, Bitbucket, Bamboo, and Crowd. WatchTowr traced it to path-handling in the shared atlassian-plugins-webresource library, which can expose webroot files such as crowd.properties and the credentials used to reach Crowd, potentially enabling user or privilege changes. On October 7, VulnCheck added the flaw to its known-exploited list after activity targeting Bamboo Data Center; it was not in CISA’s KEV catalog at publication. Atlassian listed fixed versions and temporary WAF or rewrite mitigations and said it cannot confirm whether instances were compromised.

Infosecurity Magazineupdated 14:04 UTC · 6h agofirst 10:05 UTC · 10h agoExploit / PoC in the wild 21 sources CVE-2026-215891

Atlassian Vulnerability Comes Under Attack Hours After Details Go Public

Attackers are exploiting critical Atlassian flaw CVE-2026-21589 to read sensitive files on Data Center products.

Attackers are exploiting CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-read flaw in Atlassian Data Center products including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. watchTowr Labs found that double-colon sequences are treated as path separators, allowing reads of webroot files; in one Crowd deployment, crowd.properties credentials were used to create a Jira administrator. Previdian reported 15 attempts from three IP addresses in Japan and the United States, and honeypot exploitation started about two hours after the analysis. Fixed builds include Bitbucket 9.4.26, 10.2.8 and 10.5.1, Confluence 9.2.26 and 10.2.19, plus listed Jira, Bamboo, Crowd, Crucible, and Fisheye releases.

Security Affairsupdated 14:04 UTC · 6h agofirst 07:26 UTC · 13h agoExploit / PoC in the wild 21 sources CVE-2026-21589

Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)

Attackers are probing Atlassian Data Center products for critical file-read flaw CVE-2026-21589 one day after patches.

One day after Atlassian patched CVE-2026-21589, a critical arbitrary file-access flaw in self-managed Data Center products, Previdian reported exploitation attempts against its honeypots. watchTowr traced the bug to atlassian-plugins-webresource, where double colons are converted to slashes and bypass path filters, allowing reads of files such as WEB-INF/web.xml. On Crowd, crowd.properties can expose plaintext application credentials that let an attacker list users, create accounts, and add them to groups such as jira-administrators. Affected products include Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye; Atlassian urges upgrades or isolating instances from the internet.

Help Net Securityupdated 14:04 UTC · 6h agofirst Oct 7, 14:21 UTC · 1d agoExploit / PoC in the wild 21 sources CVE-2026-21589

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Atlassian patched CVE-2026-21589, an unauthenticated file-read flaw in eight products, with public proof-of-concept code available.

On October 5, 2026, Atlassian disclosed CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-access flaw affecting Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. watchTowr found double-colon sequences become path separators during web-resource handling, allowing reads throughout the application web root but not outside the Tomcat context. A public Python file-read proof-of-concept and Nuclei template are available. Cloud products are already patched; on-premises customers should upgrade to the listed fixed versions, treat WAF rules as temporary, and search access logs for encoded traversal.

Rapid7 Blogupdated 14:04 UTC · 6h agofirst Oct 7, 12:11 UTC · 1d agoVulnerability 21 sources CVE-2026-215891

Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

Unauthenticated Atlassian Data Center flaw CVE-2026-21589 saw exploitation attempts within two hours.

Atlassian disclosed CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-access flaw in Data Center editions of Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. An attacker who already knows an exact path can read files under the web root; on Crowd and Jira that can include crowd.properties and lead to administrative access. Previdian reported 15 honeypot attempts from three IP addresses in Japan and the United States, starting about two hours after watchTowr published technical details. Atlassian says Cloud is patched, fixed Data Center builds are available, and temporary options include removing instances from the internet or applying WAF and rewrite rules.

The Hacker Newsupdated 14:04 UTC · 6h agofirst Oct 7, 11:49 UTC · 1d agoExploit / PoC in the wild 21 sources CVE-2026-21589

Atlassian Patches Critical Vulnerability Affecting 8 Products

Atlassian patched unauthenticated file-read flaw CVE-2026-21589 in eight products, and no exploitation has been observed.

Atlassian patched CVE-2026-21589, a critical arbitrary file access flaw with a CVSS score of 9.3. Unauthenticated attackers who already know an exact path can read specific files in the web root but cannot enumerate directories. All versions of Bitbucket, Bamboo, Crowd, Crucible, Confluence, Fisheye, Jira Service Management, and Jira Software Data Center are affected, with fixes in multiple current branches. Atlassian and WatchTowr say exploitation has not been observed, though Crowd deployments may store SSO credentials in plaintext at a predictable path.

SecurityWeekupdated 14:04 UTC · 6h agofirst Oct 7, 06:37 UTC · 1d agoVulnerability 21 sources CVE-2026-21589

Atlassian’s critical flaw turns eight enterprise products into one big security problem

Unauthenticated CVE-2026-21589 lets attackers read web-root files on eight Atlassian Data Center products; exploitation is unconfirmed.

Atlassian disclosed CVE-2026-21589, a critical CVSS 9.3 arbitrary file access flaw in its Data Center software. Unauthenticated attackers who already know an exact file name and path can read files in the web application root and, using path traversal, potentially reach files outside it; directory listing is not possible. All versions of Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Service Management, and Jira Software Data Center are affected. Atlassian says its cloud offerings are patched and it has not found evidence of exploitation, and it urges customers to upgrade or immediately remove exposed instances from the internet.

CSO Onlineupdated 14:04 UTC · 6h agofirst Oct 7, 01:51 UTC · 1d agoVulnerability 21 sources CVE-2026-215891

CVE-2026-21589 | Atlassian Data Center Products Unauthenticated Arbitrary File Read Vulnerability

Atlassian Data Center products have critical unauthenticated file-read flaw CVE-2026-21589, with no known exploitation.

CVE-2026-21589 lets unauthenticated remote attackers read specific files in the web root of affected Atlassian Data Center products if they know the exact path. Directory listing is not possible. Atlassian rates it critical, says Cloud products are patched, and reports no evidence of exploitation. Fixed releases include Bitbucket 9.4.26, 10.2.8 and 10.5.1, Confluence 9.2.26 and 10.2.19, plus updates for Jira, Bamboo, Crowd, Crucible, and Fisheye. Horizon3 released a NodeZero test to check exposure.

Horizon3.aiupdated 14:04 UTC · 6h agofirst Oct 6, 23:15 UTC · 1d agoVulnerability 21 sources CVE-2026-215891

Atlassian warns of critical file-access flaw in Jira, Confluence

Atlassian warns CVE-2026-21589 allows unauthenticated file access in self-hosted Jira, Confluence, Bitbucket, and other Data Center products.

Atlassian disclosed CVE-2026-21589, a critical arbitrary file-access flaw in several self-hosted Data Center products. An unauthenticated attacker who knows a file's exact name and path can read specific files in the web root but cannot list directories. Fixes include Confluence 9.2.26 and 10.2.19, Jira Software 9.12.40, 10.3.26, and 11.3.12, plus updates for Bitbucket, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Cloud instances were patched automatically, and Atlassian says it has no evidence of exploitation.

BleepingComputerupdated 14:04 UTC · 6h agofirst Oct 6, 17:34 UTC · 2d agoVulnerability 21 sources CVE-2026-21589

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)

Atlassian patched CVE-2026-21589, a pre-auth arbitrary file read affecting Jira, Confluence, Bitbucket, and other Data Center products.

On October 5, 2026, Atlassian issued an out-of-band advisory for CVE-2026-21589, which it called arbitrary file access and watchTowr assessed as a pre-authentication arbitrary file read. The flaw affects prior versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center, with fixes in current supported branches. watchTowr traced it to a shared web-resource plugin library and cited roughly 700,000 internet-facing Confluence instances. The research is framed as exposure validation ahead of in-the-wild exploitation; none is reported.

watchTowr Labsupdated 14:04 UTC · 6h agofirst Oct 6, 17:01 UTC · 2d agoVulnerability 21 sources CVE-2026-21589

Atlassian urges immediate patching of critical Data Center file access vulnerability (CVE-2026-21589)

Atlassian warns unauthenticated attackers can read files on Data Center products via critical CVE-2026-21589.

Atlassian disclosed CVE-2026-21589, a critical arbitrary file access flaw scored 9.3 under CVSS 4.0, affecting all versions of its Data Center products including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye. An unauthenticated attacker who knows an exact file name and path can read files under the web application root, but cannot enumerate directories. Cloud products are patched and Atlassian reported no evidence of exploitation; it urges Data Center customers to upgrade to fixed releases or take instances off the internet.

Help Net Securityupdated 14:04 UTC · 6h agofirst Oct 6, 12:26 UTC · 2d agoVulnerability 21 sources CVE-2026-215892

Atlassian Patches Critical Vulnerabilities in Jira, Confluence, Bitbucket, and Five More Products

Atlassian patched CVE-2026-21589, a CVSS 9.3 unauthenticated file-access flaw in eight Data Center products.

Atlassian disclosed CVE-2026-21589, a critical arbitrary file-access flaw rated CVSS 9.3, affecting eight Data Center products including Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Unauthenticated attackers who know an exact file name and path can read files in the application web root, but cannot list directories. Fixed releases are available for each product, and Atlassian Cloud is already patched. The vendor reports no evidence of exploitation and offers temporary WAF or Tomcat RewriteValve mitigations until upgrades are applied.

Cyber Security Newsupdated 14:04 UTC · 6h agofirst Oct 6, 08:18 UTC · 2d agoVulnerability 21 sources CVE-2026-215891

Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

CVE-2026-21589 lets unauthenticated attackers read known files in eight self-hosted Atlassian Data Center products.

Atlassian disclosed CVE-2026-21589 on October 5, a CVSS 9.3 path traversal in eight customer-hosted Data Center products. An unauthenticated attacker who already knows an exact filename and path can read files in the web-application root but cannot list the directory. Fixed builds include Confluence 9.2.26 and 10.2.19, Jira Software 9.12.40, 10.3.26, and 11.3.12, plus updates for Jira Service Management, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Cloud is patched with no evidence of exploitation; self-hosted impact is unconfirmed, temporary URL blocks are not a patch substitute, and the CVE record conflicts with some advisory fix versions, while prior Jira traversal CVE-2021-26086 is in CISA's KEV catalog.

The Hacker Newsupdated 14:04 UTC · 6h agofirst Oct 6, 06:58 UTC · 2d agoVulnerability 21 sources CVE-2026-21589 CVE-2021-26086

Bamboo Data Center

Timeline13 articles

Related CVEsby mentions

Appears with