Atlassian flaw exploited two hours after watchTowr's report

Previdian’s honeypot network started logging exploitation attempts against CVE-2026-21589 within two hours of watchTowr publishing a technical report and a proof-of-concept, according to the company’s Ryan Dewhurst. The flaw is an unauthenticated arbitrary file-access bug in self-hosted Atlassian products, disclosed by Atlassian on Monday. A Nuclei template is now out, which automates scanning for vulnerable instances.

The vulnerability affects eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian’s advisory told administrators to patch as soon as possible and said it cannot tell whether individual customer instances have already been compromised.

On its own, the bug lets an unauthenticated attacker read a file from the application’s web root, provided they know the exact name and path. The root cause is a shared web-resource library that converts double colons (”::”) into forward slashes (”/”). watchTowr used that to build directory-traversal requests through plugin resource endpoints and pull protected application files without logging in. The researchers confirmed file reads in Jira, Confluence, and Bitbucket but could not traverse outside the Tomcat application context, so the reach is bounded to files inside the app.

That bound still leaves a serious escalation path in Crowd-integrated deployments. Atlassian Crowd handles centralized identity, SSO, authentication, authorization, and access across connected Data Center apps. In a Crowd-integrated Jira deployment, an attacker can read plaintext application credentials from WEB-INF/classes/crowd.properties and use them against Crowd’s API to create a Jira administrator account. The same credentials grant administrator access to Crowd itself, which lets an attacker create users and modify permissions across every app wired into it.

The escalation has conditions. Crowd has to be reachable from the compromised app, and the app needs sufficient permissions. watchTowr notes that an allowlist of permitted IPs makes the attack much harder: “[An attacker] would need to pivot through arbitrary machines or use SSRF-like capabilities of Jira, Confluence, or Bitbucket to reach Crowd directly.”

Patching is the clean fix, and Atlassian’s bulletin lists the fixed versions. If you cannot patch immediately, the recommended mitigations are to restrict external network access and add a WAF or proxy rule that blocks the traversal patterns across all affected products. Atlassian provides Tomcat RewriteValve rules for Confluence, Jira Service Management, Jira, Bamboo, and Crowd, and a URL rewrite rule for Bitbucket. watchTowr has released a free scanner to check whether an instance is vulnerable.

Previdian has seen attempts from three addresses so far and recommends blocking them: 38.60.157[.]86, 146.70.187[.]234, and 159.26.119[.]225. Dewhurst expects activity to climb over the coming days, given how fast the first attempts appeared, the automated scanning templates, and the number of affected products.