A critical Atlassian bug now sits on CISA’s Known Exploited Vulnerabilities list, and federal agencies have a deadline to fix it. Tracked as CVE-2026-21589, the flaw carries a 9.3 severity score and impacts Data Center products.
Atlassian classifies it as an arbitrary file access issue. Reading specific files inside the web application root is possible for an unauthenticated attacker, but only when the exact file name and path are already known. Since directory enumeration is off the table, reconnaissance is a prerequisite for any successful strike.
The double-colon quirk
The technical analysis from watchTowr Labs, published on October 6 after it compared vulnerable against patched packages, describes a path traversal. Its unusual mechanism: double-colon sequences that the software treats as path separators, which lets files in the application web root be read.
Credentials leaked in one case: reading crowd.properties on a Crowd deployment paired with Jira handed the researchers application credentials, which they used to spin up a user and place it in the jira-administrators group.
The roster of vulnerable offerings spans Bamboo, Confluence, Crowd, Crucible, Fisheye, Bitbucket, Jira Software and Jira Service Management.
Attacks are underway
Fifteen exploitation attempts, originating from three IP addresses in Japan and the U.S., have shown up in Previdian’s telemetry. According to founder Ryan Dewhurst, the activity has started reaching the company’s honeypot network.
Given that a precise path is required, any exposed configuration detail should be treated as a sharp uptick in risk. Patch immediately, rotate credentials that could sit in readable config files, and check access logs for probing of known file names.
