Atlassian CVE-2026-21589 Under Active Attack: Jira and Confluence Exploited 2 Hours After PoC Release
Hackers are exploiting CVE-2026-21589 in Jira, Confluence and Bitbucket Data Center to steal crowd.properties credentials. Here's what to do now.
Vulnerabilities
Critical Atlassian Flaw CVE-2026-21589 Lets Attackers Read Files in Jira, Confluence and Bitbucket Data Center Without Logging In
CVE-2026-21589 (CVSS 9.3) affects eight Atlassian Data Center products; Cloud is already patched. Fixed versions and what to do if you can't patch yet.
Atlassian is warning about a critical vulnerability, CVE-2026-21589 (CVSS 9.3), in eight of its Data Center products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye. The flaw allows an attacker to read files from the web application’s root directory without logging in.
How serious is this vulnerability?
Atlassian points to two limitations. The attacker must know the exact file name and path, and cannot list the contents of directories. In practice, these limits offer little protection, because the file structure of these products is widely known. Researchers at watchTowr note that configuration files, keys and internal documentation often end up in the application directory.
As of publication, no attacks exploiting this flaw have been reported, and the vendor has not identified any public exploit code. However, previous Confluence vulnerabilities show that mass internet scanning often starts within days of an advisory being published, not weeks.
Cloud versions (Atlassian Cloud) are already patched and require no action.
Fixed versions
| Product | Fixed versions |
|---|---|
| Bitbucket Data Center | 9.4.26, 10.2.8, 10.5.1 |
| Confluence Data Center | 9.2.26, 10.2.19 |
| Jira Software Data Center | 9.12.40, 10.3.26, 11.3.12 |
| Jira Service Management Data Center | 5.12.40, 10.3.26, 11.3.12 |
| Bamboo Data Center | 10.2.24, 12.1.12 |
| Crowd Data Center | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Crucible and Fisheye | 4.9.15 |
What to do
- Update to one of the versions listed above.
- If you can’t update right away, take your instances off the internet (using a VPN or an IP allowlist), or apply one of the three temporary workarounds described in Atlassian’s advisory.
- Add rules to your web application firewall (WAF) that block requests containing the
..sequence in the path. - Review your server logs for requests like these. If you find any, treat the keys and passwords stored in application files as compromised and rotate them.
SecurHUB’s take
At many companies, Jira and Confluence serve as the “organizational memory”: passwords pasted into tickets, network diagrams, procedures. That’s why Data Center instances should not be reachable from the internet unless there’s a real need. We check for this during our network penetration testing and system hardening services.
Sources: Atlassian, Help Net Security, watchTowr
