Atlassian CVE-2026-21589 under attack hours after watchTowr showed a path to Jira admin
Attackers began probing CVE-2026-21589, the critical file-read flaw in Atlassian's Data Center products, on October 6, hours after watchTowr published an analysis showing it can expose plaintext Crowd credentials that let attackers make themselves Jira administrators. By October 12, Previdian's honeypots had logged 377 exploitation attempts from 57 IP addresses in 19 countries. Patching or cutting instances off from the internet is urgent.
Atlassian disclosed CVE-2026-21589 (CVSS 9.3) on October 5. It affects all versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, as well as Crucible and Fisheye, and lets an unauthenticated attacker read specific files in the web application root if they know the exact path. At the time, Atlassian said it had found no evidence of exploitation.
On October 6, watchTowr published its analysis. It traced the bug to a web-resource library shared by the products, where routing code that turns double colons into slashes lets a path-traversal payload slip through, and showed it could read any file in the application server. The critical part is Crowd: deployments keep crowd.properties, with the Crowd application name and password in plaintext, in a readable location. With those credentials an attacker can talk to Crowd directly, create a user and add it to the jira-administrators group.
Exploitation intelligence firm Previdian first recorded attempts against the flaw in its honeypots at 21:55 UTC on October 6, hours after the write-up. By October 12 it had logged 377 attempts from 57 attacker IP addresses in 19 countries; a Nuclei scanner template appeared on October 7. CISA has not yet added the flaw to its Known Exploited Vulnerabilities catalog. Atlassian advises upgrading to fixed versions, or cutting internet-facing instances off from external networks or applying its firewall and rewrite rules until they can be patched.