U.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Atlassian CVE-2026-21589 to KEV, ordering federal fixes by October 18, 2026.
CISA added CVE-2026-21589, a CVSS 9.3 arbitrary file-access flaw in Atlassian Data Center products, to its Known Exploited Vulnerabilities catalog after exploitation began in early October. Unauthenticated attackers who know an exact file path can read files under the web application root; directory listing is not possible. watchTowr described a path-traversal issue involving double-colon sequences and, in one Crowd-plus-Jira setup, read crowd.properties credentials and created a jira-administrators user. Previdian reported 15 attempts from three Japanese and U.S. IP addresses, with honeypot hits starting about two hours after further technical details were published. Federal agencies must patch by October 18, 2026.
- CVE-2026-21589 is an unauthenticated arbitrary file-access flaw scored CVSS 9.3.
- Affected products include Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye.
- CISA KEV requires federal agencies to remediate by October 18, 2026.
- Previdian saw 15 attempts from three IPs in Japan and the United States.
- Researchers showed Crowd credentials could be read and used to create a Jira administrator.
Vulnerabilities mentionedAll →
- CVE-2026-215899.33%Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerabilitypublished · Atlassian Multiple Products KEV PoC ×9
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Full article552 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Atlassian flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Atlassian flaw, tracked as CVE-2026-21589 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog.
In early October, threat actors started exploiting CVE-2026-21589, a critical arbitrary file access flaw in Atlassian Data Center products. The vulnerability could allow attackers to access sensitive files under certain conditions. Affected products include Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye.
“This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file’s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents.” reads the advisory. “In some configurations, there may be some sensitive files that make this highly severe.”
Previdian telemetry has detected 15 exploitation attempts from three IP addresses in Japan and the U.S..
“Exploitation has now started to hit our honeypot network” Previdian Founder Ryan Dewhurst wrote on LinkedIn.
On October 6, watchTowr Labs published a technical analysis of CVE-2026-21589 after comparing vulnerable and patched Atlassian packages.
Researchers found a path traversal flaw where double-colon (::) sequences can be treated as path separators, allowing attackers to read files from the application web root.
“While semicolons (;) are very common in path traversal within Java applications, along with the everyday dots (.) and slashes (/), one item stood out: the matching of double colons (::).” reads the analysis. “This is uncommon syntax for this type of vulnerability, but grepping through the codebase we came across an all too familiar sight.”
In one Crowd deployment with Jira, researchers were able to read crowd.properties, which exposed application credentials. They then used those credentials to create a user and add it to the jira-administrators group. Crowd IP allowlisting can block this attack path.
Exploitation attempts against its honeypot network reportedly began two hours after watchTowr published additional technical details about the vulnerability.
According to watchTowr, the problem is in Atlassian’s web-resource handling. It can turn a string such as ..::..::..::..::WEB-INF::web.xml into ../../../../WEB-INF/web.xml, allowing attackers to move through directories and access files they should not be able to read.
Atlassian says all versions before the listed fixed versions are affected:
| Product | Fixed versions |
|---|---|
| Bitbucket Data Center | 9.4.26, 10.2.8, 10.5.1 |
| Confluence Data Center | 9.2.26, 10.2.19 |
| Jira Service Management Data Center | 5.12.40, 10.3.26, 11.3.12 |
| Jira Software Data Center | 9.12.40, 10.3.26, 11.3.12 |
| Bamboo Data Center | 10.2.24, 12.1.12 |
| Crowd Data Center | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Crucible | 4.9.15 |
| Fisheye | 4.9.15 |
watchTowr has released a free tool on GitHub to help check if a server is vulnerable.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the flaw by October 18, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)