Atlassian Data Center CVE-2026-21589: unauthenticated file read in Jira, Confluence, Bitbucket, Bamboo, Crowd, Fisheye and Crucible, exploited

What happened

On 5 October 2026, Atlassian disclosed CVE-2026-21589, rated CVSS 4.0 9.3. An unauthenticated attacker can read specific files inside the web application root directory. They must know the exact file name and path; the bug cannot list directories (Atlassian). Atlassian said Cloud was patched and it found no evidence of exploitation there. For Data Center it said it “cannot confirm if your instances have been affected”.

On 6 October, watchTowr traced the bug to the shared atlassian-plugins-webresource library, fixed by moving from 6.0.7 to 6.0.8. The resource router turns :: back into /, so a request such as /download/resources/<plugin>/images/..::..::..::WEB-INF::web.xml walks out of a plugin’s resource folder. watchTowr used it to read WEB-INF/classes/crowd.properties from Jira. That file holds the Crowd application name, its plaintext password and the Crowd URL. With those, watchTowr called the Crowd REST API, created a user and added it to jira-administrators (watchTowr). A firewall rule that limits which IPs can use the Crowd API could block that last step.

On 7 October, VulnCheck added the CVE to its own KEV list, citing exploitation against Bamboo Data Center (Infosecurity Magazine). CISA added it on 15 October, with a due date of 18 October (CISA KEV).

Am I affected?

Every Data Center version below these fixed builds is affected (Atlassian):

The CVE record traces the bug back to Jira 7.1.0, Confluence 5.10.0, Bitbucket 4.6.0, Bamboo 7.0.1 and Crowd 2.11.0 (CVE record). Atlassian no longer ships binary patches, so you need a full upgrade.

Check versions over HTTP:

curl -s https://jira.example.com/rest/api/2/serverInfo
curl -s https://confluence.example.com/rest/applinks/1.0/manifest
curl -s https://bitbucket.example.com/rest/api/1.0/application-properties
curl -s https://bamboo.example.com/rest/api/latest/info

watchTowr published a detection artefact generator for Jira, Confluence and Bitbucket in the GitHub repository watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589 (watchTowr).

Search access logs for attempts. Atlassian says to look for .. next to /, \ or ::, either after URL-decoding each line up to twice, or by running its regex over the raw lines. Search the product’s Tomcat access logs and any reverse proxy or load balancer logs in front of it:

grep -P '(?i)(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$)' access_log*

Pay most attention to hits that returned HTTP 200 and that name crowd.properties, web.xml, urlrewrite.xml or other files under WEB-INF.

What to do now

1. Upgrade every Data Center product to a fixed build. Start with internet-facing ones and with Bamboo and Bitbucket, which hold build secrets and source code. Atlassian says to take instances off the internet until you can patch or mitigate.
2. If you cannot upgrade yet, block the pattern. Atlassian gives three options (Atlassian): - a WAF or proxy rule that blocks URLs matching the regex above (all products); - a Tomcat RewriteValve in the application <Context> plus a rewrite.config in WEB-INF that returns 403 for the same pattern (Jira, JSM, Confluence, Bamboo, Crowd), applied on every cluster node; - a new first rule in <installation-directory>/app/WEB-INF/urlrewrite.xml that returns 404 (Bitbucket, including mirrors and mirror farm nodes). Test that the rule also blocks URL-encoded forms.
3. Change the Crowd application password used by Jira, Confluence and other apps if the instance was reachable while unpatched. crowd.properties stores it in plain text and watchTowr showed how it leads to Jira admin. Restrict the Crowd REST API to the IP addresses of the applications that use it.
4. Look for new admin users. Review recent members of jira-administrators, confluence-administrators and other admin groups in Crowd and in each product. Look for users created through the Crowd REST API (POST /crowd/rest/usermanagement/1/user) that you cannot explain.
5. Check other files in the web root for secrets. Atlassian warns that in some configurations sensitive files there “increase your risk”. Anything stored under the application’s WEB-INF should be treated as readable by anyone who reached the instance before the fix.

Sources

• Atlassian: CVE-2026-21589 arbitrary file access vulnerability impacts multiple products
• watchTowr Labs: Atlassian pre-auth arbitrary file read (CVE-2026-21589)
• CVE-2026-21589 record
• CISA Known Exploited Vulnerabilities catalog
• Infosecurity Magazine: critical vulnerability in Atlassian products exploited