Atlassian file-read flaw CVE-2026-21589 draws rapid probes

Atlassian patched unauthenticated file-read flaw CVE-2026-21589 across eight Data Center products; honeypot probes followed public details, but customer compromises are not confirmed.

On October 5, 2026, Atlassian disclosed CVE-2026-21589, a critical unauthenticated arbitrary file-access flaw with a CVSS score of 9.3. Most outlets say earlier versions of eight self-managed Data Center products are affected—Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye—while The Hacker News and Help Net Security list seven and do not separate Jira Service Management. Reporters agree an unauthenticated attacker must already know an exact path, can read named web-root files, and cannot list directories; CSO Online says traversal may reach files outside the web root, but Rapid7 says reads remain inside the Tomcat context through the shared atlassian-plugins-webresource library. watchTowr estimated roughly 700,000 internet-facing Confluence instances and warned that Crowd crowd.properties can expose plaintext credentials usable to create administrators. Atlassian Cloud is reported already patched, and cited fixed builds include Bitbucket 9.4.26, 10.2.8, and 10.5.1 and Confluence 9.2.26 and 10.2.19, while temporary WAF, proxy, and rewrite rules are described as not replacing an upgrade or removing exposed instances from the internet. Early accounts from Atlassian and watchTowr said no exploitation was known, whereas later reports describe Previdian honeypot activity within about two hours of public details—15 attempts from three IPs, later 190 from 32 IPs in 10 countries by October 8—and VulnCheck listing the bug on October 7 after Bamboo-targeted activity, even though CISA’s KEV catalog had not added it and Atlassian had not confirmed compromises.