Atlassian Flaw Targeted Hours After PoC Release
Attackers began targeting a critical vulnerability in Atlassian’s self-hosted Data Center products within hours of researchers publishing proof-of-concept code.
The vulnerability, tracked as CVE-2026-21589, affects Atlassian’s Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye products. Atlassian disclosed it on October 5 and gave it a CVSS score of 9.3. Fixes are available for all affected versions.
The flaw allows remote, unauthenticated attackers to retrieve specific files from a web application’s root directory. They must know the exact file name and path. The vulnerability cannot be used to list directory contents.
Researchers published technical details and proof-of-concept code on October 6. The issue affects a library shared by the products. Exploitation attempts were later detected in internet-facing honeypots.
The risk is greater when Jira is connected to Crowd, Atlassian’s identity management product. In that configuration, an attacker may be able to read a file containing Crowd application credentials stored in plaintext. Researchers used exposed credentials to create a new user and add it to Jira’s administrators group. They described direct access to Crowd with the credentials as “basically game over.”
An exploitation intelligence firm recorded the first attempts on October 6, several hours after the technical details were published. By October 8, it had logged 190 attempts from 32 IP addresses in 10 countries.
Atlassian advises organizations to install the available updates. Organizations that cannot patch immediately should remove affected instances from the internet or apply the firewall and rewrite rules provided by Atlassian.
The U.S. Cybersecurity and Infrastructure Security Agency had not added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog as of October 8.
Articles by this author
