Yesterday we told you to patch self-hosted Atlassian. Since then, the bug picked up a public exploit, a Nuclei scanning template, and live attack traffic. If your Jira, Confluence or Bitbucket Data Center servers are still on old builds, that patch moves from “this week” to “this morning.”
Two hours. That’s how long it took from a public write-up to the first exploit attempts in the honeypots.
What happened
Atlassian disclosed CVE-2026-21589 on Monday, October 5. It’s an unauthenticated file-access flaw (CVSS 4.0: 9.3) in eight self-managed products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye. On Tuesday, watchTowr Labs published a full technical write-up and proof of concept. The flaw sits in a shared web-resource library that turns double colons (::) into slashes, which lets a request walk out of a plugin’s resource folder and read files like WEB-INF/web.xml without logging in.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Previdian told BleepingComputer its honeypots logged exploitation attempts within about two hours of the watchTowr post. Previdian’s tracker shows the first sensor hit on October 6. By early October 8 (UTC) it had logged 117 attempts from 15 IPs in seven countries. A Nuclei template followed on October 7. CISA’s KEV catalog had not listed the CVE as of Wednesday evening; its last update was October 4.
Why it matters
On its own, the bug reads files inside the web app. It can’t reach the rest of the server. watchTowr’s point is that sometimes that’s enough. If Jira is integrated with Atlassian Crowd, WEB-INF/classes/crowd.properties holds the application’s Crowd password in plaintext. With that password, an attacker who can reach Crowd can create a user and add it to jira-administrators. watchTowr notes that a Crowd IP allowlist makes this much harder. Plenty of installs don’t have one.
Atlassian Cloud is already patched. This is a self-hosted problem, and watchTowr counted just under 700,000 internet-facing Confluence instances alone.
What to do first
- Upgrade every affected product to a fixed build today. If an internet-facing instance can’t be upgraded yet, take it off the internet.
- If it must stay online, apply Atlassian’s mitigations: the WAF/proxy rule for traversal patterns, Tomcat RewriteValve rules (Confluence, Jira, JSM, Bamboo, Crowd), or the
urlrewrite.xmlrule for Bitbucket. Treat them as a stopgap. - If Jira, Confluence or Bitbucket uses Crowd: rotate the application password in
crowd.propertiesafter patching, and restrict Crowd to known application IPs. - Audit Crowd and
jira-administratorsfor users created or added since October 6. - Block the three source IPs Previdian shared publicly (listed below).
Forward this
For whoever runs our self-hosted Jira, Confluence or Bitbucket: the Atlassian flaw from Monday now has public exploit code and active attacks. Please patch today or take the servers off the internet. If we use Crowd, also rotate its application password.
Details
- CVE: CVE-2026-21589, CWE-552, CVSS 4.0 9.3. Unauthenticated. The attacker needs the exact file name and path; it can’t list directories.
- Fixed builds: Jira Software 9.12.40 / 10.3.26 / 11.3.12; Jira Service Management 5.12.40 / 10.3.26 / 11.3.12; Confluence 9.2.26 / 10.2.19; Bitbucket 9.4.26 / 10.2.8 / 10.5.1; Bamboo 10.2.24 / 12.1.12; Crowd 6.3.7 / 7.0.3 / 7.1.7 / 7.2.4; Crucible and Fisheye 4.9.15.
- Timeline: Advisory Oct 5 · watchTowr write-up and PoC Oct 6 · first honeypot hits Oct 6 · Nuclei template Oct 7 · BleepingComputer report Oct 7.
- Scope limit: watchTowr could not traverse outside the Tomcat application context.
- KEV: Not listed as of October 7 evening ET.
Hunt / verify
- Grep access logs for
..::in request paths, especially under/download/resources/and/s/…/_/download/resources/, and forWEB-INFin any URL. - Look for requests from
38.60.157.86,146.70.187.234and159.26.119.225. - Run watchTowr’s detection artifact generator against your own instances to confirm the patch took.
- In Crowd, review the audit log for new users, group changes and application logins from unexpected sources since October 6.
Atlassian CVE-2026-21589 is now exploited: public PoC (watchTowr, Oct 6), Nuclei template, honeypot hits within ~2 hours. Patch Jira / JSM / Confluence / Bitbucket / Bamboo / Crowd / Fisheye / Crucible Data Center today or pull them off the internet. Crowd users: rotate the crowd.properties app password and check jira-administrators for new members.
Sources
- BleepingComputer: Hackers exploit critical Atlassian flaw after public PoC release
- watchTowr Labs: Atlassian Jira, Confluence (and more) pre-auth arbitrary file read CVE-2026-21589
- Previdian: CVE-2026-21589 exploitation observed
- Atlassian: CONFSERVER-104488 · JRASERVER-79546 · BSERV-20604
- CVE.org: CVE-2026-21589
- CyberExperts, Oct 7: the original patch brief
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
