Critical Atlassian Data Center Flaw Exploited Two Hours After Technical Details Went Public

A critical vulnerability affecting eight of Atlassian’s self-hosted Data Center products is now being exploited, according to two security firms. Attackers started sending exploit attempts roughly two hours after researchers published technical details of the bug.

The flaw is tracked as CVE-2026-21589 and carries a CVSS severity score of 9.3 out of 10, as reported by The Hacker News. It affects Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye when they are run on an organization’s own servers. Atlassian says its Cloud products were patched automatically and cloud customers do not need to take any action.

What the vulnerability does

Atlassian describes CVE-2026-21589 as an arbitrary file access vulnerability. In plain terms, someone with no username or password can ask the server for specific files stored inside the application’s web root directory, and the server hands them over.

There are limits. According to Atlassian’s advisory, the attacker has to already know the exact name and location of the file they want, and the bug does not let them list the contents of folders to go browsing. That sounds restrictive, but enterprise Java applications such as Jira and Confluence store important configuration files in well-known, predictable places, so attackers often know exactly what to ask for.

The underlying technique is called path traversal. Web applications are supposed to serve files only from approved folders. A path traversal bug lets an attacker sneak in sequences such as “../” (meaning “go up one folder”) so the request escapes the approved area and reaches files that were never meant to be public. Security firm Previdian, as cited by The Hacker News, said the issue sits in the way Atlassian’s software handles “web resources”. Strings written in a specific format are converted into traversal sequences, and combined with a quirk in how a color-picker plugin resource handles a trailing slash, this can reach files such as WEB-INF/web.xml, a core configuration file for Java web applications. Path traversal was also the root cause of the FortiMail zero-day we covered earlier this month.

Why it matters

Reading configuration files can be a stepping stone to a full takeover. The Hacker News reports that on Crowd and Jira, an attacker could read a file called crowd.properties, which contains credentials for Atlassian Crowd, the component that manages users and logins. Those credentials could then be used to gain administrator access, including creating new user accounts and promoting one of them to Jira Administrator.

Jira and Confluence often hold sensitive internal information such as source code, project plans, incident notes and internal documentation, which makes them attractive targets. Atlassian’s self-hosted products have been targeted before. In 2022, we reported on active exploitation of a Confluence flaw tied to a hard-coded password (CVE-2022-26138).

Exploitation timeline

When BleepingComputer first reported on the advisory on October 6, Atlassian said it had no evidence the flaw was being exploited. That changed after security firm watchTowr published additional technical details.

Previdian reported that its honeypots (decoy systems set up to attract and record attacks) saw exploitation activity begin two hours after watchTowr’s publication. It recorded 15 exploitation attempts from three unique IP addresses located in Japan and the United States: 38.60.157[.]86, 146.70.187[.]234 and 159.26.119[.]225. Previdian CEO Ryan Dewhurst said a Nuclei template, a ready-made scanning rule for a popular open-source tool, would make mass scanning easier.

The short gap between publication and attack follows a pattern seen in recent months, including a GeoServer flaw exploited within hours of disclosure and a JFrog Artifactory bug attacked days after its patch.

Jake Knott, head of threat intelligence at watchTowr, confirmed in-the-wild exploitation. He said most attempts observed so far involve fingerprinting products and sweeping for common configuration and sensitive files. He added: “No post-compromise activity or attackers attempting to utilize the credentials” had been observed at the time of reporting.

As of the sources reviewed for this article, the original discoverer of the vulnerability has not been publicly named.

Fixed versions

• Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1
• Confluence Data Center: 9.2.26, 10.2.19
• Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12
• Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12
• Bamboo Data Center: 10.2.24, 12.1.12
• Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4
• Crucible: 4.9.15
• Fisheye: 4.9.15

What administrators should do

Atlassian recommends upgrading to a fixed version. For organizations that cannot patch immediately, the vendor lists several temporary mitigations, as summarized by The Hacker News:

• Remove affected instances from the public internet.
• Apply a web application firewall (WAF) rule to block the malicious requests.
• Block the requests using Tomcat’s RewriteValve on Confluence, Jira Service Management, Jira, Bamboo and Crowd.
• Add a blocking rule to urlrewrite.xml on Bitbucket.

BleepingComputer also notes that Atlassian advises administrators to review access logs for the traversal patterns described in its security bulletin. Given that Crowd credentials can be exposed, teams that find signs of probing may also want to rotate those credentials and review recently created or elevated admin accounts.

Sources

• Atlassian security advisory: CVE-2026-21589 Arbitrary File Access Vulnerability Impacts Multiple Products
• The Hacker News: Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details (October 7, 2026)
• BleepingComputer: Atlassian warns of critical file access flaw in Jira, Confluence (October 6, 2026)