Atlassian CVE-2026-21589 exploited: patch Jira and Confluence

If you still run Jira, Confluence or Bitbucket on your own server, stop and check your version. Atlassian CVE-2026-21589 is an unauthenticated file-read flaw with a CVSS v4.0 score of 9.3. It hits eight self-hosted Data Center and Server products. A public proof of concept came out on October 6, and attack attempts started within hours. CISA has not listed it as known-exploited yet. Do not wait for that.

What actually happened

Atlassian published its security advisory on October 5. An attacker with no login can request specific files inside the application's web root. Atlassian says the attacker must know the exact file name and path, and cannot list directories.

That limit matters less than it sounds. Per SecurityWeek, researchers at watchTowr showed that when Jira is connected to Crowd, a config file holds the Crowd application credentials in plain text. With those, they created a user and added it to the Jira administrators group. File read became admin access.

watchTowr published its analysis and PoC on October 6. Previdian's honeypots logged the first attempts the same day. By October 8 it counted 190 attempts from 32 IP addresses in 10 countries. Atlassian says it has no evidence of exploitation against customers.

Affected products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. Fixed versions, from watchTowr's FAQ:

• Jira Software / Jira Service Management: 9.12.40 / 5.12.40, 10.3.26, 11.3.12
• Confluence: 9.2.26, 10.2.19
• Bitbucket: 9.4.26, 10.2.8, 10.5.1
• Crowd: 6.3.7, 7.0.3, 7.1.7, 7.2.4
• Bamboo: 10.2.24, 12.1.12 · Crucible / Fisheye: 4.9.15

The advisory covers self-hosted products only. Atlassian Cloud is not listed.

Why it matters for your business

Your Jira and Confluence hold more than tickets. They hold API keys pasted into pages, deploy notes, customer data and the map of your systems. A file read on that box can leak the credentials to everything else.

What we would do today:

• Patch to a fixed version. That is the only real fix.
• If you cannot patch tonight, pull it off the public internet. Put it behind a VPN or an IP allowlist. Atlassian's WAF and rewrite rules are a stopgap, not a fix.
• Rotate secrets. If the instance was exposed since October 6, assume config files were read. Rotate Crowd app passwords, database credentials and any tokens in the web root.
• Search your access logs for path traversal: two dots next to a slash, backslash or double colon, after URL-decoding.
• Audit your admin groups for accounts nobody remembers creating.

Sources: Atlassian, SecurityWeek, watchTowr.