Crucible (Product): news timeline & CVEs

Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication

Attackers probed critical Atlassian CVE-2026-21589 within hours of a public PoC, with 190 honeypot attempts.

Atlassian disclosed CVE-2026-21589 on October 5, rating the self-hosted Data Center flaw CVSS 9.3 across Bitbucket, Confluence, Jira, Bamboo, Crowd, and related products. A remote unauthenticated attacker who knows an exact path can read files in the web root; WatchTowr showed that Crowd integration can expose plaintext credentials used to create a Jira administrator. Previdian honeypots recorded exploitation attempts starting October 6, reaching 190 attempts from 32 IP addresses by October 8. Patches are available, and CISA has not yet added the bug to the KEV catalog.

SecurityWeek14:04 UTC · 6h agoExploit / PoC in the wild 21 sources CVE-2026-21589

Critical Flaw in Multiple Atlassian Products Exploited in the Wild

Unauthenticated Atlassian flaw CVE-2026-21589 is exploited in the wild to read Data Center application files.

Atlassian disclosed CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-read flaw affecting eight self-managed Data Center products, including Jira, Confluence, Bitbucket, Bamboo, and Crowd. WatchTowr traced it to path-handling in the shared atlassian-plugins-webresource library, which can expose webroot files such as crowd.properties and the credentials used to reach Crowd, potentially enabling user or privilege changes. On October 7, VulnCheck added the flaw to its known-exploited list after activity targeting Bamboo Data Center; it was not in CISA’s KEV catalog at publication. Atlassian listed fixed versions and temporary WAF or rewrite mitigations and said it cannot confirm whether instances were compromised.

Infosecurity Magazineupdated 14:04 UTC · 6h agofirst 10:05 UTC · 10h agoExploit / PoC in the wild 21 sources CVE-2026-215891

Atlassian Vulnerability Comes Under Attack Hours After Details Go Public

Attackers are exploiting critical Atlassian flaw CVE-2026-21589 to read sensitive files on Data Center products.

Attackers are exploiting CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-read flaw in Atlassian Data Center products including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. watchTowr Labs found that double-colon sequences are treated as path separators, allowing reads of webroot files; in one Crowd deployment, crowd.properties credentials were used to create a Jira administrator. Previdian reported 15 attempts from three IP addresses in Japan and the United States, and honeypot exploitation started about two hours after the analysis. Fixed builds include Bitbucket 9.4.26, 10.2.8 and 10.5.1, Confluence 9.2.26 and 10.2.19, plus listed Jira, Bamboo, Crowd, Crucible, and Fisheye releases.

Security Affairsupdated 14:04 UTC · 6h agofirst 07:26 UTC · 13h agoExploit / PoC in the wild 21 sources CVE-2026-21589

Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)

Attackers are probing Atlassian Data Center products for critical file-read flaw CVE-2026-21589 one day after patches.

One day after Atlassian patched CVE-2026-21589, a critical arbitrary file-access flaw in self-managed Data Center products, Previdian reported exploitation attempts against its honeypots. watchTowr traced the bug to atlassian-plugins-webresource, where double colons are converted to slashes and bypass path filters, allowing reads of files such as WEB-INF/web.xml. On Crowd, crowd.properties can expose plaintext application credentials that let an attacker list users, create accounts, and add them to groups such as jira-administrators. Affected products include Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye; Atlassian urges upgrades or isolating instances from the internet.

Help Net Securityupdated 14:04 UTC · 6h agofirst Oct 7, 14:21 UTC · 1d agoExploit / PoC in the wild 21 sources CVE-2026-21589

PoC Exploit Released for Critical Atlassian Flaw That Can Lead to Jira Admin Access

watchTowr released a detection PoC for unauthenticated Atlassian file-read CVE-2026-21589 that can yield Jira admin access.

watchTowr published a detection proof of concept for CVE-2026-21589, a critical unauthenticated arbitrary file-read flaw in multiple self-managed Atlassian Data Center products. Shared web-resource handling converts double colons into slashes, enabling directory traversal to files under the application webroot, including WEB-INF. If Jira is integrated with Crowd, crowd.properties can expose application credentials that may allow creation of a jira-administrators account. Atlassian issued fixes on October 5, including Jira Software 9.12.40, 10.3.26, and 11.3.12; in-the-wild exploitation is not reported.

Cyber Security Newsupdated 14:04 UTC · 6h agofirst Oct 7, 13:30 UTC · 1d agoExploit / PoC 21 sources CVE-2026-21589

Hackers exploit critical Atlassian flaw after public PoC release

Attackers began exploiting critical Atlassian flaw CVE-2026-21589 within hours of a public proof of concept.

Attackers are exploiting CVE-2026-21589, a critical unauthenticated arbitrary file-access flaw in self-hosted Atlassian products including Jira, Confluence, Bitbucket, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Previdian observed honeypot exploitation within two hours of watchTowr publishing a proof of concept, from three source addresses. In some Crowd-integrated deployments, reading WEB-INF/classes/crowd.properties can expose credentials used to create a Jira administrator. A Nuclei template is available, and Atlassian urges immediate patching or WAF and rewrite mitigations.

BleepingComputerupdated 14:04 UTC · 6h agofirst Oct 7, 12:49 UTC · 1d agoExploit / PoC in the wild 21 sources CVE-2026-21589

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Atlassian patched CVE-2026-21589, an unauthenticated file-read flaw in eight products, with public proof-of-concept code available.

On October 5, 2026, Atlassian disclosed CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-access flaw affecting Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. watchTowr found double-colon sequences become path separators during web-resource handling, allowing reads throughout the application web root but not outside the Tomcat context. A public Python file-read proof-of-concept and Nuclei template are available. Cloud products are already patched; on-premises customers should upgrade to the listed fixed versions, treat WAF rules as temporary, and search access logs for encoded traversal.

Rapid7 Blogupdated 14:04 UTC · 6h agofirst Oct 7, 12:11 UTC · 1d agoVulnerability 21 sources CVE-2026-215891

Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

Unauthenticated Atlassian Data Center flaw CVE-2026-21589 saw exploitation attempts within two hours.

Atlassian disclosed CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-access flaw in Data Center editions of Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. An attacker who already knows an exact path can read files under the web root; on Crowd and Jira that can include crowd.properties and lead to administrative access. Previdian reported 15 honeypot attempts from three IP addresses in Japan and the United States, starting about two hours after watchTowr published technical details. Atlassian says Cloud is patched, fixed Data Center builds are available, and temporary options include removing instances from the internet or applying WAF and rewrite rules.

The Hacker Newsupdated 14:04 UTC · 6h agofirst Oct 7, 11:49 UTC · 1d agoExploit / PoC in the wild 21 sources CVE-2026-21589

Atlassian Patches Critical Vulnerability Affecting 8 Products

Atlassian patched unauthenticated file-read flaw CVE-2026-21589 in eight products, and no exploitation has been observed.

Atlassian patched CVE-2026-21589, a critical arbitrary file access flaw with a CVSS score of 9.3. Unauthenticated attackers who already know an exact path can read specific files in the web root but cannot enumerate directories. All versions of Bitbucket, Bamboo, Crowd, Crucible, Confluence, Fisheye, Jira Service Management, and Jira Software Data Center are affected, with fixes in multiple current branches. Atlassian and WatchTowr say exploitation has not been observed, though Crowd deployments may store SSO credentials in plaintext at a predictable path.

SecurityWeekupdated 14:04 UTC · 6h agofirst Oct 7, 06:37 UTC · 1d agoVulnerability 21 sources CVE-2026-21589

Atlassian’s critical flaw turns eight enterprise products into one big security problem

Unauthenticated CVE-2026-21589 lets attackers read web-root files on eight Atlassian Data Center products; exploitation is unconfirmed.

Atlassian disclosed CVE-2026-21589, a critical CVSS 9.3 arbitrary file access flaw in its Data Center software. Unauthenticated attackers who already know an exact file name and path can read files in the web application root and, using path traversal, potentially reach files outside it; directory listing is not possible. All versions of Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Service Management, and Jira Software Data Center are affected. Atlassian says its cloud offerings are patched and it has not found evidence of exploitation, and it urges customers to upgrade or immediately remove exposed instances from the internet.

CSO Onlineupdated 14:04 UTC · 6h agofirst Oct 7, 01:51 UTC · 1d agoVulnerability 21 sources CVE-2026-215891

CVE-2026-21589 | Atlassian Data Center Products Unauthenticated Arbitrary File Read Vulnerability

Atlassian Data Center products have critical unauthenticated file-read flaw CVE-2026-21589, with no known exploitation.

CVE-2026-21589 lets unauthenticated remote attackers read specific files in the web root of affected Atlassian Data Center products if they know the exact path. Directory listing is not possible. Atlassian rates it critical, says Cloud products are patched, and reports no evidence of exploitation. Fixed releases include Bitbucket 9.4.26, 10.2.8 and 10.5.1, Confluence 9.2.26 and 10.2.19, plus updates for Jira, Bamboo, Crowd, Crucible, and Fisheye. Horizon3 released a NodeZero test to check exposure.

Horizon3.aiupdated 14:04 UTC · 6h agofirst Oct 6, 23:15 UTC · 1d agoVulnerability 21 sources CVE-2026-215891

Atlassian warns of critical file-access flaw in Jira, Confluence

Atlassian warns CVE-2026-21589 allows unauthenticated file access in self-hosted Jira, Confluence, Bitbucket, and other Data Center products.

Atlassian disclosed CVE-2026-21589, a critical arbitrary file-access flaw in several self-hosted Data Center products. An unauthenticated attacker who knows a file's exact name and path can read specific files in the web root but cannot list directories. Fixes include Confluence 9.2.26 and 10.2.19, Jira Software 9.12.40, 10.3.26, and 11.3.12, plus updates for Bitbucket, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Cloud instances were patched automatically, and Atlassian says it has no evidence of exploitation.

BleepingComputerupdated 14:04 UTC · 6h agofirst Oct 6, 17:34 UTC · 2d agoVulnerability 21 sources CVE-2026-21589

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)

Atlassian patched CVE-2026-21589, a pre-auth arbitrary file read affecting Jira, Confluence, Bitbucket, and other Data Center products.

On October 5, 2026, Atlassian issued an out-of-band advisory for CVE-2026-21589, which it called arbitrary file access and watchTowr assessed as a pre-authentication arbitrary file read. The flaw affects prior versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center, with fixes in current supported branches. watchTowr traced it to a shared web-resource plugin library and cited roughly 700,000 internet-facing Confluence instances. The research is framed as exposure validation ahead of in-the-wild exploitation; none is reported.

watchTowr Labsupdated 14:04 UTC · 6h agofirst Oct 6, 17:01 UTC · 2d agoVulnerability 21 sources CVE-2026-21589

Atlassian security advisory (AV26-1002)

Canada's Cyber Centre warns Atlassian server products are affected by arbitrary file access CVE-2026-21589.

The Canadian Centre for Cyber Security issued advisory AV26-1002 on October 5, 2026, for Atlassian arbitrary file access vulnerability CVE-2026-21589. Affected products include specified Data Center and Server versions of Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Service Management, and Jira Software, with all Server versions listed for several products. The Cyber Centre told administrators to review Atlassian's advisories and apply updates as they become available. The bulletin does not report that the flaw is being exploited.

Canadian Centre for Cyber Securityupdated 14:04 UTC · 6h agofirst Oct 6, 13:44 UTC · 2d agoAdvisory 21 sources CVE-2026-215891

Atlassian urges immediate patching of critical Data Center file access vulnerability (CVE-2026-21589)

Atlassian warns unauthenticated attackers can read files on Data Center products via critical CVE-2026-21589.

Atlassian disclosed CVE-2026-21589, a critical arbitrary file access flaw scored 9.3 under CVSS 4.0, affecting all versions of its Data Center products including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye. An unauthenticated attacker who knows an exact file name and path can read files under the web application root, but cannot enumerate directories. Cloud products are patched and Atlassian reported no evidence of exploitation; it urges Data Center customers to upgrade to fixed releases or take instances off the internet.

Help Net Securityupdated 14:04 UTC · 6h agofirst Oct 6, 12:26 UTC · 2d agoVulnerability 21 sources CVE-2026-215892

Atlassian Patches Critical Vulnerabilities in Jira, Confluence, Bitbucket, and Five More Products

Atlassian patched CVE-2026-21589, a CVSS 9.3 unauthenticated file-access flaw in eight Data Center products.

Atlassian disclosed CVE-2026-21589, a critical arbitrary file-access flaw rated CVSS 9.3, affecting eight Data Center products including Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Unauthenticated attackers who know an exact file name and path can read files in the application web root, but cannot list directories. Fixed releases are available for each product, and Atlassian Cloud is already patched. The vendor reports no evidence of exploitation and offers temporary WAF or Tomcat RewriteValve mitigations until upgrades are applied.

Cyber Security Newsupdated 14:04 UTC · 6h agofirst Oct 6, 08:18 UTC · 2d agoVulnerability 21 sources CVE-2026-215891

Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

CVE-2026-21589 lets unauthenticated attackers read known files in eight self-hosted Atlassian Data Center products.

Atlassian disclosed CVE-2026-21589 on October 5, a CVSS 9.3 path traversal in eight customer-hosted Data Center products. An unauthenticated attacker who already knows an exact filename and path can read files in the web-application root but cannot list the directory. Fixed builds include Confluence 9.2.26 and 10.2.19, Jira Software 9.12.40, 10.3.26, and 11.3.12, plus updates for Jira Service Management, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Cloud is patched with no evidence of exploitation; self-hosted impact is unconfirmed, temporary URL blocks are not a patch substitute, and the CVE record conflicts with some advisory fix versions, while prior Jira traversal CVE-2021-26086 is in CISA's KEV catalog.

The Hacker Newsupdated 14:04 UTC · 6h agofirst Oct 6, 06:58 UTC · 2d agoVulnerability 21 sources CVE-2026-21589 CVE-2021-26086

Atlassian warns of critical file access flaw in its datacenter products

Atlassian urges patches for CVE-2026-21589, an unauthenticated file-read flaw in eight Data Center products.

Atlassian emailed customers an “Action required” notice for CVE-2026-21589, a CVSS 9.3 arbitrary file-access flaw in Data Center editions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. An unauthenticated attacker who knows an exact filename and path can read specific files under the web application root; directory listing is not possible, but some configurations may hold sensitive files. Patched versions are available, and Atlassian Cloud is already fixed. Customers who cannot upgrade immediately are told to remove internet-exposed instances from external access.

The Register · Securityupdated 14:04 UTC · 6h agofirst Oct 6, 04:20 UTC · 2d agoVulnerability 21 sources CVE-2026-215891

Has anybody seen my keys? A key-hierarchy strategy for rack-level security

Oxide's RFD 0301 proposes a rack-level key hierarchy using Shamir secret sharing and a trust quorum to protect data-at-rest keys.

Oxide's request for discussion (RFD 0301) lays out a key-hierarchy strategy for rack-level security, deriving keys from a rack secret protected by Shamir secret sharing across a trust quorum of sleds, with keys exchanged over authenticated sprockets sessions. The document maps which keys protect control-plane data, metrics, Crucible extents, and authentication tokens, and defines open questions on key lifecycle, locality, and compromise handling. Future work includes sealing shares with the root of trust so an attacker would need to steal K whole sleds to reconstruct the rack secret.

Hacker News · securitySep 7, 02:14 UTC · Sep 7, 2026Research HN 52↑ · 3 comments

Crucible

Timeline19 articles

Related CVEsby mentions

Appears with