Attackers are reading files off self-hosted Jira and Confluence. CISA wants them patched by Sunday

We flagged this Atlassian bug on October 7 and again on October 8, when public exploit code and honeypot hits showed up. On Thursday CISA added it to its Known Exploited Vulnerabilities catalog, so the government now says attacks are confirmed, not just attempted.

Federal agencies have until Sunday, October 18, to fix it. If your company runs Jira, Confluence, Bitbucket, Bamboo or Crowd on its own servers, that is a fair deadline for you too.

Ten days after the advisory, the Atlassian file-read bug is officially exploited. Self-hosted Jira and Confluence get a Sunday deadline.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

CISA confirms attacks on the Atlassian file-read bug

CISA added CVE-2026-21589 to the KEV catalog on October 15, 2026, “based on evidence of active exploitation,” with a federal due date of October 18. The catalog entry covers Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye. Its notes point agencies to CISA’s Forensics Triage Requirements, which means checking for a compromise, not only installing the fix.

Atlassian published the advisory on October 5 and rates the flaw 9.3 (CVSS 4.0). An unauthenticated attacker can read specific files inside the web application root, as long as they know the file’s exact name and path. Atlassian Cloud was patched and needs no customer action.

Self-hosted Data Center servers still on old builds

Every version of the eight self-managed products before the fixed builds is affected, according to Atlassian. The bug cannot list directories, but watchTowr’s write-up in October showed that a known file can be enough: on Jira installs linked to Crowd, crowd.properties holds the application’s Crowd password in plain text.

Atlassian’s own advice for servers that cannot be patched yet is to take them off the internet, including instances that sit behind a login page. CISA has not said who is behind the attacks or whether ransomware groups are involved; the catalog lists that as unknown.

Patch every Atlassian Data Center app by Sunday

• Upgrade to a fixed build: Jira Software 9.12.40, 10.3.26 or 11.3.12; Jira Service Management 5.12.40, 10.3.26 or 11.3.12; Confluence 9.2.26 or 10.2.19; Bitbucket 9.4.26, 10.2.8 or 10.5.1; Bamboo 10.2.24 or 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7 or 7.2.4; Crucible and Fisheye 4.9.15.
• If a server cannot be upgraded before Sunday, pull it off the internet, or apply Atlassian’s WAF regex, Tomcat RewriteValve rule or Bitbucket urlrewrite.xml rule as a stopgap.
• Search access logs for .. next to /, \ or ::, after URL-decoding each line up to twice, as Atlassian’s advisory describes.
• If Jira or Confluence talks to Crowd, rotate the application password in crowd.properties after patching and review Crowd for new admin users.

Details

• CVE-2026-21589: files or directories accessible to external parties (CWE-552), CVSS 4.0 score 9.3, no authentication. Atlassian advisory dated October 5, 2026.
• KEV: added October 15, 2026; federal due date October 18, 2026; ransomware use listed as unknown.
• Affected: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, Crucible and Fisheye, all versions before the fixed builds above. Atlassian Cloud is patched.
• Our earlier coverage: October 7 patch brief and October 8 exploit follow-up.

Hunt / verify

• Decoded request paths containing ..:: or WEB-INF, especially under /download/resources/, since October 5.
• Crowd audit log entries for new users, group changes or application logins from unknown IP addresses.
• Re-run your exposure scan after patching to confirm each node in a Data Center cluster reports the fixed build.

Source: Atlassian advisory, CVE-2026-21589; CISA KEV alert, October 15, 2026

Sources

• Atlassian: CVE-2026-21589 Arbitrary File Access Vulnerability impacts Multiple Products
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (October 15, 2026)
• watchTowr Labs: Atlassian Jira, Confluence (and more) pre-auth arbitrary file read CVE-2026-21589
• CVE.org: CVE-2026-21589

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].