Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Summary: Atlassian disclosed a critical arbitrary file access flaw, CVE-2026-21589 with a CVSS score of 9.3, affecting Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye Data Center products, allowing an unauthenticated attacker to read specific files in the web application root directory if they know the exact name and path. Previdian recorded 15 exploitation attempts from three IP addresses in Japan and the U.S. beginning two hours after watchTowr published technical details, and CISA added the flaw to its KEV catalog on October 15, 2026, with a fix deadline of October 18, 2026 for FCEB agencies.
Key Takeaway: The path-resolution trick can pull WEB-INF/classes/crowd.properties, which stores Crowd credentials, and those credentials can be used to create a rogue user and elevate it to Jira Administrator - so a single unauthenticated request can end in administrative control of the application.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-21589
- Related
- CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Known Exploited Vulnerabilities · Oct 15, 2026