Hackers exploit critical Atlassian flaw after public PoC release

A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication.

Earlier today, security company Previdian detected the activity on its honeypot network, just hours after a detailed technical report was published.

An unauthenticated attacker can exploit CVE-2026-21589 to access specific files in the application's web root directory if they know the file's exact name and path.

The issue is an arbitrary file-access flaw disclosed on Monday, and it affects self-hosted instances of eight Atlassian products:

• Bitbucket Data Center
• Confluence Data Center
• Jira Service Management Data Center
• Jira Software Data Center
• Bamboo Data Center
• Crowd Data Center
• Crucible
• Fisheye

In a security advisory on Monday, Atlassian warned system administrators managing self-hosted instances to apply the security updates as soon as possible, noting it cannot determine whether individual customer instances have been compromised.

Following Atlassian’s advisory, offensive security company watchTowr published a technical report showing how CVE-2026-21589 could be exploited to gain administrator-level access to Jira, Confluence, and Bitbucket in certain Crowd-integrated deployments.

Atlassian Crowd provides centralized identity management, single sign-on (SSO), authentication, authorization, and access management for connected Data Center apps.

The researchers exploited the root cause of the flaw, which is a shared web-resource library that converts double colons "::" into forward slashes "/", to construct directory-traversal requests through plugin resource endpoints and retrieve protected application files without authentication.

watchTowr researchers confirmed file reads in Jira, Confluence, and Bitbucket, but their technique could not traverse outside the Tomcat application context.

In Crowd-integrated Jira deployments, attackers could read plaintext application credentials from WEB-INF/classes/crowd.properties and use them to create a Jira administrator account through Crowd’s API.

This applies if Crowd is reachable and the application has sufficient permissions. However, the researchers note that specifying a list of allowed IP addresses would make exploitation significantly more difficult.

"[An attacker] would need to pivot through arbitrary machines or use SSRF-like capabilities of Jira, Confluence, or Bitbucket to reach Crowd directly," the researchers say.

The leaked credentials in crowd.properties provide administrator access to the Crowd identity management system, allowing attackers to create new users and modify permissions.

According to Previdian, the technical details were sufficient to help threat actors scan for exposed vulnerable instances and probe them.

“Within two hours of watchTowr publishing its technical research and public PoC for CVE-2026-21589, Previdian's honeypot network began observing exploitation attempts targeting the vulnerability,” Previdian’s Ryan Dewhurst told BleepingComputer.

“A Nuclei template has also now been released, making it significantly easier to automate scanning for vulnerable systems.”

The company has so far observed attempts from these three IP addresses: 38.60.157[.]86, 146.70.187[.]234, and 159.26.119[.]225, and recommends blocking them.

Dewhurst expects exploitation activity to increase significantly over the coming days and weeks, driven by the rapid emergence of exploitation attempts following the public PoC, the availability of automated scanning templates, and the broad range of affected Atlassian products.

System administrators should apply available security updates as soon as possible, or apply the recommended mitigations.

This includes restricting external network access, adding a web application firewall (WAF) or proxy rule blocking specified traversal patterns across all affected products, Tomcat RewriteValve rules for Confluence, JSM, Jira, Bamboo, and Crowd, or a URL rewrite rule for Bitbucket.

For more details about the fixed versions and mitigation steps, check out Atlassian’s bulletin.

watchTowr has also released a free scanner tool to help administrators determine if their instances are vulnerable to CVE-2026-21589.