Atlassian published a security advisory on 5 October 2026 for CVE-2026-21589, an arbitrary file access flaw (recorded as path traversal) in Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. An attacker with no login can read specific files inside the web application root directory, but must already know each file's exact name and path; the flaw does not let them list directory contents.

Atlassian says some configurations hold sensitive files there, which raises the risk. Atlassian rates it Critical, 9.3 under CVSS v4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H), as its own internal assessment. All versions before the listed fixes are affected, which can include end-of-life versions.

Affected Atlassian Cloud products are already patched and Atlassian says its investigation found no evidence of exploitation there; Bitbucket Cloud is not affected.

For self-hosted instances Atlassian says it cannot confirm whether any have been hit, and tells customers to search access logs for requests where .. sits directly next to /, \ or :: (after URL-decoding up to twice). It offers three temporary blocking rules (a WAF or proxy regex, a Tomcat RewriteValve rule, and a file change; Crucible and Fisheye only get the first) and says they are not a replacement for patching.

Primary: Atlassian security advisory.

UPDATE (watchTowr Labs, 6 Oct 2026): watchTowr published a technical analysis, a Python proof of concept and a detection artefact generator. It traces the bug to the shared atlassian-plugins-webresource library, which turns :: back into / in web-resource download paths, so a request such as /download/resources/<plugin-key>/images/..::..::WEB-INF::web.xml walks out of a plugin's resource folder. watchTowr showed working routes on Jira, Confluence and Bitbucket.

Reads stay inside the Tomcat web application, but that includes WEB-INF. On Jira set up to use Crowd as described in Atlassian's documentation, WEB-INF/classes/crowd.properties holds the Crowd application name and password; watchTowr used those to call the Crowd REST API, list users, create a new user and add it to jira-administrators. With public exploit code out, expect scanning and exploitation to follow quickly.

UPDATE (7 Oct 2026): exploitation attempts have started. Previdian says its honeypot network saw attempts within two hours of watchTowr's write-up and exploit code going public, 15 attempts from three IP addresses in Japan and the US (38.60.157[.]86, 146.70.187[.]234 and 159.26.119[.]225), and a Nuclei scanning template is now out, so it expects activity to climb over the coming days. watchTowr has also released a free scanner to check whether an instance is vulnerable.

Sources: BleepingComputer and The Hacker News (7 Oct). CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on 15 October 2026 with an 18 October due date for US federal agencies (source: CISA KEV catalog).

Correction (24 Oct 2026): The CVE record for CVE-2026-21589 (Atlassian, updated 19 October) now lists the same fixed versions as Atlassian's advisory for all eight Data Center products and no longer lists Server editions, so the earlier note that it differed for Crowd and Bamboo and listed Server editions with no fix has been removed. (source: CVE record CVE-2026-21589)

Correction (25 Oct 2026): removed an 8 October attempt count credited to a wire report we cannot read. Previdian's own page for CVE-2026-21589 (telemetry updated 24 October) says its sensors recorded 644 exploitation attempts from 78 unique attacker IP addresses in 22 countries, first observed on 6 October and last observed on 23 October. (source: Previdian)