Atlassian File Access Flaw Faces Attacks Hours After Exploit Release

Attackers have begun targeting a critical vulnerability in self-hosted Atlassian software following the release of public proof-of-concept code. The Atlassian file access flaw, tracked as CVE-2026-21589, affects eight product families, including Jira, Confluence and Bitbucket.

Security company Previdian reported exploitation attempts on its honeypot network within two hours of researchers publishing technical details. However, those observations do not establish how many customer systems attackers have compromised.

Eight Atlassian Product Families Affected

Atlassian disclosed the vulnerability on October 5 and urged administrators to install security updates promptly. The affected products are:

• Bitbucket Data Center
• Confluence Data Center
• Jira Service Management Data Center
• Jira Software Data Center
• Bamboo Data Center
• Crowd Data Center
• Crucible
• Fisheye

The vulnerability allows unauthenticated attackers to retrieve certain files within an application’s web root. However, they must know the exact filename and path.

Atlassian also said it cannot determine whether individual customer installations have suffered a compromise.

File Exposure Can Enable Administrator Access

Researchers at watchTowr traced the weakness to a shared library that handles web resources. The library converts double colons into forward slashes, allowing specially crafted requests to bypass intended file-access restrictions.

During testing, researchers retrieved protected files from Jira, Confluence and Bitbucket without signing in. However, their technique could not reach beyond the Tomcat application context.

The consequences can extend beyond exposed files in some Crowd-integrated environments. Crowd manages identities, authentication and access permissions across connected applications.

In certain Jira deployments, researchers retrieved plaintext application credentials from a Crowd configuration file. They then demonstrated how those credentials could enable the creation of a Jira administrator account through Crowd’s API.

That escalation depends on Crowd being reachable and the application account having sufficient permissions. Consequently, file access does not automatically grant administrator control over every affected installation.

Restricting Crowd access to approved IP addresses makes that attack path more difficult. An attacker would then need another way to reach the service.

Public Research Quickly Followed by Attack Attempts

Previdian detected exploitation attempts shortly after watchTowr released its research and proof-of-concept code on October 7.

Meanwhile, a publicly available Nuclei template has made automated vulnerability scanning easier. Together, these releases lower the effort required to identify and probe exposed installations.

Previdian reported attempts originating from three IP addresses:

• 38.60.157[.]86
• 146.70.187[.]234
• 159.26.119[.]225

The company recommended blocking those addresses. It also predicted that activity would increase over the following days and weeks, citing the broad product exposure and available scanning tools.

However, the reported honeypot activity confirms exploitation attempts rather than successful administrator takeovers of customer systems.

Updates and Mitigations Require Prompt Attention

Administrators should prioritize the available security updates for the Atlassian file access flaw. Where immediate patching is impractical, Atlassian recommends product-specific mitigations.

These include restricting external network access and configuring a web application firewall or proxy to block the relevant traversal patterns.

Additional options include Tomcat RewriteValve rules for Confluence, Jira Service Management, Jira, Bamboo and Crowd. For Bitbucket, the guidance includes a URL rewrite rule.

Administrators should follow the instructions for their particular product and deployment. Meanwhile, watchTowr has released a free scanner to help identify vulnerable instances.