CVE-2026-21589: Multiple Atlassian Data Center Products Actively Exploited
CVE-2026-21589 (CVSS 9.3, EPSS ≥ 78th pctl) is a critical-severity arbitrary file access vulnerability [CWE-552] affecting Atlassian Jira Service Management Data Center, Jira Software Data Center, Confluence Data Center, Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. All unpatched versions of the affected products are vulnerable. The file access vulnerability can be further leveraged for admin account takeover under certain conditions when Crowd SSO is in use. CVE-2026-21589 is considered actively exploited [1][2][3][4], but has not been added to CISA’s KEV list as of October 13th, 2026.
A detailed technical analysis of the full attack chain, including Jira admin account takeover, is available. Proof-of-concept (PoC) exploits for the unauthorized file read [5][6][7][8] and full account-takeover chain [9] are also publicly available. Multiple national CERT agencies have issued alerts for the flaw [10][11][12][13][14][15][16][17][18][19][20].
Start Your Free Trial
Immediately after CVE-2026-21589 was disclosed, the OPENVAS ENTERPRISE FEED added detection across all affected Atlassian products:
Remote banner check for Atlassian Jira Service Management Data Center [1]
Active check and remote banner check for Atlassian Jira Software Data Center [2][3]
Active check and remote banner check for Atlassian Confluence [4][5]
Active check and remote banner check for Atlassian Bitbucket [6][7]
Remote banner check for Atlassian Bamboo [8]
Remote banner check for Atlassian Crowd [9]
Remote banner check for Atlassian Fisheye and Crucible [10]
Greenbone’s ENTERPRISE FEED also includes regular detection for emerging vulnerabilities affecting Atlassian products. A trial copy of OPENVAS SCAN includes a free two-week trial of the ENTERPRISE FEED, with over 250,000 vulnerability tests and counting.
A Risk Assessment of CVE-2026-21589 in Atlassian Data Center Products
Atlassian Data Center products are self-hosted enterprise platforms used for project tracking, documentation, build automation, identity management, code review, and more. That makes CVE-2026-21589 a high risk across a broad set of business-critical workflows. Furthermore, Atlassian products have historically been leveraged by ransomware gangs and Advanced Persistent Threat (APT) groups. Atlassian products are listed 13 times on CISA’s KEV list; 8 instances have been flagged for ransomware activity.
CVE-2026-21589 allows unauthenticated attackers to access files within the web application root directory, and when Crowd SSO is in use, attackers may also be able to create accounts and assign administrative privileges. The full attack chain can result in unauthorized admin access. The vulnerability’s actively exploited status and the availability of detailed technical information and PoC exploits further increase the risk.
Technical Details for CVE-2026-21589 in Atlassian Data Center Products
CVSS 9.3 · CriticalEPSS 1.8% (78th)Actively exploitedPublic PoC
CVE-2026-21589 (CVSS 9.3, EPSS ≥ 78th pctl) allows unauthenticated attackers to access files [CWE-552] within the web application root directory if the exact file name and path are already known. Exploitation requires prior knowledge of the exact target file name and path. CVE-2026-21589 does not allow attackers to enumerate or list directory contents. When Crowd SSO is in use and has sufficient permissions to create users and modify group memberships, attackers can create accounts and achieve admin takeover.
The vulnerability originates in the shared Atlassian Web Resource Plugin, specifically its handling of resource paths in the atlassian-plugins-webresource library. The Router.unescapeSlashes() function converts double-colon (::) sequences into forward slashes (/), allowing attackers to construct directory traversal payloads that bypass path restrictions. By submitting malicious HTTP requests to web resource endpoints, an unauthenticated attacker can exploit the resource-serving functionality to read otherwise inaccessible files within the application’s webroot directory tree. This includes sensitive configuration files under the WEB-INF directory.
Jira installations integrated with Atlassian Crowd may expose the WEB-INF/classes/crowd.properties configuration file, which contains the Crowd application name, plaintext application password, and Crowd server URL. If an attacker can obtain these credentials and has access to the Crowd server, they can authenticate to its REST API, enumerate existing users, create new accounts, and modify group memberships.
watchTowr Labs researchers created a new Crowd user and added it to the jira-administrators group, achieving Jira administrator privileges. This exploitation scenario depends on Crowd integration, exposed credentials, and network accessibility to the Crowd service. Highly restrictive Crowd IP allowlists can limit exploitability.
Affected Products and Mitigation for CVE-2026-21589 in Atlassian Data Center Products
CVE-2026-21589 affects Jira Service Management Data Center, Jira Software Data Center, Confluence Data Center, Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. All versions prior to the fixed versions are affected. Users should urgently update affected instances within their IT environment, giving priority to those that are internet-accessible.
Atlassian has provided web application firewall (WAF) rules to mitigate the vulnerability across all affected products, along with Tomcat RewriteValve rules for Confluence, Jira Service Management, Jira Software, Bamboo, and Crowd. For Bitbucket, Atlassian has provided a rule that can be added to urlrewrite.xml. The vendor-provided workarounds are temporary mitigations only.
The fixed versions are shown below:
Summary
CVE-2026-21589 is a critical-severity, actively exploited, unauthenticated arbitrary file read vulnerability affecting all unpatched versions across multiple Atlassian Data Center products. The flaw allows access to specific files in the web application root directory when an attacker already knows the exact file path and name. Attackers may also leverage CVE-2026-21589 to gain administrator privileges when Crowd SSO is in use. Users should immediately restrict access to internet-facing instances and urgently update to a patched version.
Start Your Free Trial
Immediately after CVE-2026-21589 was disclosed, the OPENVAS ENTERPRISE FEED added detection across all affected Atlassian products:
Remote banner check for Atlassian Jira Service Management Data Center [1]
Active check and remote banner check for Atlassian Jira Software Data Center [2][3]
Active check and remote banner check for Atlassian Confluence [4][5]
Active check and remote banner check for Atlassian Bitbucket [6][7]
Remote banner check for Atlassian Bamboo [8]
Remote banner check for Atlassian Crowd [9]
Remote banner check for Atlassian Fisheye and Crucible [10]
Greenbone’s ENTERPRISE FEED also includes regular detection for emerging vulnerabilities affecting Atlassian products. A trial copy of OPENVAS SCAN includes a free two-week trial of the ENTERPRISE FEED, with over 250,000 vulnerability tests and counting.
Joseph has had a varied and passionate background in IT and cyber security since the late 1980s. His early technical experience included working on an IBM PS/2, assembling PCs and programming in C++.
He also pursued academic studies in computer and systems engineering, anthropology and an MBA in technology forecasting.
Joseph has worked in data analytics, software development and, in particular, enterprise IT security. He specialises in vulnerability management, encryption and penetration testing.
