Atlassian CVE-2026-21589 Under Active Attack: Jira and Confluence Exploited 2 Hours After PoC Release

Attackers are already exploiting the critical CVE-2026-21589 vulnerability (CVSS 9.3) in Atlassian Data Center products. Previdian saw the first exploitation attempts in its honeypot network less than two hours after watchTowr researchers published a detailed analysis of the flaw along with working exploit code. We covered the vulnerability itself and the patched versions in yesterday’s article.

Two Hours From Publication to Attack

“Within two hours of watchTowr publishing its technical analysis and proof-of-concept code for CVE-2026-21589, our honeypot network began recording exploitation attempts,” said Ryan Dewhurst of Previdian.

The vulnerability affects eight Data Center products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye. It lets an attacker read any file in the application’s root directory without logging in. According to watchTowr, the root cause is how the application handles the :: sequence. It converts the sequence to /, which lets attackers bypass path validation.

A lot of systems are exposed. Using the FOFA device search engine, watchTowr counted roughly 700,000 internet-facing Confluence instances.

From File Read to Admin Account

Reading files may sound harmless, but in practice it leads to full system compromise. On installations connected to Atlassian Crowd, attackers download the WEB-INF/classes/crowd.properties file, which stores the application’s username and password in plain text. With those credentials, they can create an administrator account for themselves. watchTowr used this technique to demonstrate a takeover of Jira administrator privileges.

The attacks recorded by Previdian came from three IP addresses:

• 38.60.157[.]86
• 146.70.187[.]234
• 159.26.119[.]225

Check whether these addresses show up in your web server and firewall logs. Keep in mind that finding nothing proves nothing: the exploit code is public, so anyone can use it.

What to Do Now

1. Update Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye to the patched versions (the version table is in our previous article).
2. Restrict internet access to your Data Center instances, using a VPN or an IP allowlist.
3. Add rules to your web application firewall (WAF) or reverse proxy that block :: and .. sequences in request paths.
4. Search your logs from October 5 onward for requests to crowd.properties and other configuration files.
5. If an unpatched instance was reachable from the internet, rotate the application password in Crowd and any keys and tokens stored in application files, and review the list of administrators for any new accounts.

Cloud versions (Atlassian Cloud) are not affected.

SecurHUB Commentary

This case shows how much the window for response has shrunk. A few years ago, weeks would pass between a vendor advisory and mass exploitation. Today it can take just a few hours once exploit code appears online. For flaws like this, a company that patches during a monthly maintenance window will always be too late. That’s why internet-facing systems need continuous monitoring and a ready-to-go emergency patching procedure. We help with both through our 24/7 SOC monitoring and penetration testing services.

Sources: BleepingComputer, watchTowr Labs, Atlassian, CERT Orange Polska