What happened

On October 5, 2026, Atlassian published "CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products." It says all versions of Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo and Crowd Data Center, plus Crucible and Fisheye, are affected, and rates the flaw critical (CVSS v4.0 9.3). NVD scores it CVSS 3.1 7.5. In Atlassian's words, "exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents." Atlassian Cloud products "have been patched," and Atlassian found no evidence of exploitation there.

A day later, watchTowr Labs published the root cause. A shared Atlassian library that serves static web resources turns :: into /, so a request like /download/resources/…/..::..::WEB-INF::web.xml walks out of the resource folder and reads files elsewhere in the application. watchTowr counted "just under 700,000 instances of Confluence alone" on the internet and released a detection artifact generator. Within two hours, Previdian's honeypots saw exploitation attempts, BleepingComputer and The Hacker News reported. By October 8 Previdian had logged 190 attempts from 32 IP addresses in 10 countries, per SecurityWeek. CrowdSec counted a Nuclei template and around ten proof-of-concept repositories on GitHub. Most activity so far has been fingerprinting and sweeps for configuration files. A watchTowr researcher told The Hacker News that no one had yet been seen using stolen credentials. CISA added the CVE to the KEV catalog on October 15.

Why it matters if you run public infrastructure

A file read sounds limited, and watchTowr found it cannot escape the Tomcat application folder. But that folder holds more than web assets. The case watchTowr demonstrated is Jira connected to Crowd for single sign-on: WEB-INF/classes/crowd.properties stores Crowd's application password in plaintext. With that password, watchTowr used Crowd's REST API to create a user and add it to jira-administrators, which it called "basically game over." Jira and Confluence also tend to be the most internet-exposed internal tools a company runs. They are put online for contractors and remote staff, then left there, and they are full of tickets, runbooks and credentials pasted into pages.

What to check this week

  1. Find every self-hosted Atlassian product you expose, including old Server installs, staging copies and Bitbucket mirrors. Atlassian's advice is that instances, "including those with user authentication, should be restricted from external network access" until patched.
  2. Upgrade to a fixed release for each product. Jira Software 9.12.40, 10.3.26 or 11.3.12; Jira Service Management 5.12.40, 10.3.26 or 11.3.12; Confluence 9.2.26 or 10.2.19; Bitbucket 9.4.26, 10.2.8 or 10.5.1; Bamboo 10.2.24 or 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7 or 7.2.4; Fisheye and Crucible 4.9.15. Server editions past end of support have no fix and should come off the internet.
  3. If you cannot patch today, block the pattern. Atlassian's advisory gives a WAF rule (block .. next to /, \ or ::, including URL-encoded forms), a Tomcat rewrite rule for Confluence, Jira, Jira Service Management, Bamboo and Crowd, and a urlrewrite.xml rule for Bitbucket (on every node and mirror). Rapid7 notes these are "not replacements for patching."
  4. Search your access logs. Atlassian's guidance: URL-decode each request line up to twice, then look for .. immediately next to /, \ or ::. Requests to /download/resources/ containing :: are the pattern from watchTowr's write-up.
  5. Rotate what could have been read. If a Jira instance was exposed and uses Crowd, rotate the Crowd application password and check jira-administrators for accounts you did not create. Rapid7 recommends rotating exposed credentials and secrets after containment. Also turn on Crowd's IP allowlisting for each application, which blocks the takeover path watchTowr showed.

How Attack Surface Scan covers this

Attack Surface Scan recognizes Jira and Confluence from their pages on hosts under your verified domains, including hosts found through certificate transparency logs. Where the page shows the version, we match it against NVD's affected ranges for this CVE and rank it first as a KEV listing. When Confluence hides its version, we raise a potential match, capped at medium severity, with instructions for checking the real version. Bitbucket, Bamboo, Crowd, Fisheye and Crucible are not identified specifically; they show up in the host and port inventory, not as CVE findings. We do not send traversal requests or try to read files. See Vulnerability matching for the details.

Sources