Hackers exploit critical Atlassian flaw after public PoC release

Summary

A critical arbitrary file access vulnerability, CVE-2026-21589, affecting multiple self-hosted Atlassian products like Jira, Confluence, and Bitbucket, is being actively exploited. The flaw allows unauthenticated attackers to access specific files, and in Crowd-integrated deployments, can lead to administrator-level access by stealing credentials from crowd.properties.

Full text

Hackers exploit critical Atlassian flaw after public PoC release By Bill Toulas October 7, 2026 08:49 AM 0 A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication. Earlier today, security company Previdian detected the activity on its honeypot network, just hours after a detailed technical report was published. An unauthenticated attacker can exploit CVE-2026-21589 to access specific files in the application's web root directory if they know the file's exact name and path. The issue is an arbitrary file-access flaw disclosed on Monday, and it affects self-hosted instances of eight Atlassian products: Bitbucket Data Center Confluence Data Center Jira Service Management Data Center Jira Software Data Center Bamboo Data Center Crowd Data Center Crucible Fisheye In a security advisory on Monday, Atlassian warned system administrators managing self-hosted instances to apply the security updates as soon as possible, noting it cannot determine whether individual customer instances have been compromised. Following Atlassian’s advisory, offensive security company watchTowr published a technical report showing how CVE-2026-21589 could be exploited to gain administrator-level access to Jira, Confluence, and Bitbucket in certain Crowd-integrated deployments. Atlassian Crowd provides centralized identity management, single sign-on (SSO), authentication, authorization, and access management for connected Data Center apps. The researchers exploited the root cause of the flaw, which is a shared web-resource library that converts double colons "::" into forward slashes "/", to construct directory-traversal requests through plugin resource endpoints and retrieve protected application files without authentication. watchTowr researchers confirmed file reads in Jira, Confluence, and Bitbucket, but their technique could not traverse outside the Tomcat application context. In Crowd-integrated Jira deployments, attackers could read plaintext application credentials from WEB-INF/classes/crowd.properties and use them to create a Jira administrator account through Crowd’s API. This applies if Crowd is reachable and the application has sufficient permissions. However, the researchers note that specifying a list of allowed IP addresses would make exploitation significantly more difficult. "[An attacker] would need to pivot through arbitrary machines or use SSRF-like capabilities of Jira, Confluence, or Bitbucket to reach Crowd directly," the researchers say. The leaked credentials in crowd.properties provide administrator access to the Crowd identity management system, allowing attackers to create new users and modify permissions. PoC showing escalation to admin on JiraSource: watchTowr According to Previdian, the technical details were sufficient to help threat actors scan for exposed vulnerable instances and probe them. “Within two hours of watchTowr publishing its technical research and public PoC for CVE-2026-21589, Previdian's honeypot network began observing exploitation attempts targeting the vulnerability,” Previdian’s Ryan Dewhurst told BleepingComputer. “A Nuclei template has also now been released, making it significantly easier to automate scanning for vulnerable systems.” The company has so far observed attempts from these three IP addresses: 38.60.157[.]86, 146.70.187[.]234, and 159.26.119[.]225, and recommends blocking them. Dewhurst expects exploitation activity to increase significantly over the coming days and weeks, driven by the rapid emergence of exploitation attempts following the public PoC, the availability of automated scanning templates, and the broad range of affected Atlassian products. System administrators should apply available security updates as soon as possible, or apply the recommended mitigations. This includes restricting external network access, adding a web application firewall (WAF) or proxy rule blocking specified traversal patterns across all affected products, Tomcat RewriteValve rules for Confluence, JSM, Jira, Bamboo, and Crowd, or a URL rewrite rule for Bitbucket. For more details about the fixed versions and mitigation steps, check out Atlassian’s bulletin. watchTowr has also released a free scanner tool to help administrators determine if their instances are vulnerable to CVE-2026-21589. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat Related Articles: Atlassian warns of critical file-access flaw in Jira, ConfluenceNinja Forms plugin flaw exploited to hack WordPress sitesCISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacksHackers now exploit critical Roundcube flaw in code injection attacksCheck Point warns of hackers exploiting Security Gateway VPN RCE flaw

Indicators of Compromise

• cve — CVE-2026-21589
• ip — 38.60.157.86
• ip — 146.70.187.234
• ip — 159.26.119.225

Entities