Attackers began probing a critical file-read vulnerability in Atlassian's self-hosted Data Center products within hours of security firm watchTowr publishing a technical analysis, Help Net Security reported Wednesday. The flaw, CVE-2026-21589, lets an unauthenticated attacker read files from the web root of Jira, Confluence, Bitbucket and five other products.

What Happened

The Primary Wire reported Atlassian's advisory and patches Tuesday. Hours after that release, watchTowr Labs explained the root cause. The bug sits in atlassian-plugins-webresource, a library shared across the affected products, whose routing code converts double colons into forward slashes. Because the conversion happens after the code strips slashes out, a request containing sequences such as "..::..::" turns into a path traversal that reaches files elsewhere in the application.

The researchers demonstrated the attack against Jira through a route used by a color-picker plugin, reading the protected WEB-INF/web.xml configuration file, and said equivalent paths exist in Confluence and Bitbucket. As Atlassian noted, an attacker has to know the exact name and location of a file, since the flaw does not allow directory listings.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Threat intelligence firm Previdian said its honeypots recorded exploitation attempts about two hours after the write-up appeared. The Hacker News, citing Previdian, counted 15 attempts from three IP addresses located in Japan and the U.S. Jake Knott of watchTowr told the outlet that most activity so far amounts to fingerprinting exposed products and sweeping for common configuration files.

Why It Matters

The most serious scenario involves Atlassian Crowd, the single sign-on and user directory product many organizations use to manage access to Jira and Confluence. Crowd keeps a file named crowd.properties under WEB-INF/classes that stores application credentials in plaintext. According to watchTowr's analysis, an attacker who reads that file can log in to Crowd with administrative rights, create users, change permissions and promote a rogue account to Jira administrator. BleepingComputer noted that restricting access to Crowd with an IP allowlist makes that chain much harder.

The window between disclosure and attack is also shrinking. BleepingComputer reported that a template for the Nuclei scanner is now available, which makes automated searches for vulnerable servers easier, and watchTowr has published a free check script on GitHub that defenders can use to test their own systems.

Affected Products and Fixes

The vulnerability carries a CVSS score of 9.3 and affects Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, as well as Crucible and Fisheye. Atlassian's cloud services were patched before disclosure. Fixed versions include:

  • Bitbucket 9.4.26, 10.2.8 and 10.5.1
  • Confluence 9.2.26 and 10.2.19
  • Jira Software 9.12.40, 10.3.26 and 11.3.12
  • Crowd 6.3.7, 7.0.3, 7.1.7 and 7.2.4
  • Bamboo 10.2.24 and 12.1.12
  • Crucible and Fisheye 4.9.15

Atlassian advises upgrading immediately. Where that is not possible, it recommends taking internet-facing instances off external networks until they are patched and reviewing access logs for signs of exploitation. BleepingComputer said Atlassian also described temporary blocking options using web application firewall rules, URL rewriting or Tomcat's RewriteValve.

What to Watch

With a working technique public and scanning templates circulating, the early fingerprinting could broaden into automated exploitation of unpatched servers. Organizations that run Crowd on an exposed server should treat the credentials in crowd.properties as compromised if the instance was unpatched after the write-up, rotate them and audit recently created or elevated accounts. Watch also for any addition of CVE-2026-21589 to CISA's catalog of known exploited vulnerabilities, which would set patch deadlines for U.S. federal agencies.