Oct 12, 2026

Atlassian CVE-2026-21589: From file read to Jira admin in one request

CVE-2026-21589 is a CVSS 9.3 unauthenticated file read in Atlassian’s Data Center products, including Jira, Confluence, and Bitbucket. watchTowr showed it can expose a Crowd password that leads to Jira admin. CrowdSec has tracked 89 unique IP addresses sending matching requests since October 7, 2026.

You can track this CVE live here.

CVE-2026-21589 at a glance

Affected: Data Center editions of Jira Software (from 7.1.0), Jira Service Management (from 3.1.0), Confluence (from 5.10.0), Bitbucket (from 4.6.0), Bamboo (from 7.0.1), Crowd (from 2.11.0), plus Crucible and Fisheye before 4.9.15. Atlassian Cloud is already patched.
Fixed in: Jira Software 9.12.40, 10.3.26, 11.3.12 · Jira Service Management 5.12.40, 10.3.26, 11.3.12 · Confluence 9.2.26, 10.2.19 · Bitbucket 9.4.26, 10.2.8, 10.5.1 · Bamboo 10.2.24, 12.1.12 · Crowd 6.3.7, 7.0.3, 7.1.7, 7.2.4 · Crucible and Fisheye 4.9.15 (advisory, October 5, 2026)
Vulnerability class: Path traversal in a shared resource-serving library, exposing files in the web application folder (CWE-552)
Severity: CVSS 4.0: 9.3 Critical (Atlassian). NVD has not scored it yet.
Authentication required: None
Public exploit: Yes. A Nuclei template, watchTowr’s Detection Artefact Generator, and around ten GitHub proofs of concept, including a mass-scanning tool published October 6.
CISA KEV: Not listed as of October 12, 2026 (catalog last updated October 8)
CrowdSec detection rule live since: October 7, 2026
First exploitation attempt observed: October 7, 2026 by CrowdSec. Previdian reported honeypot hits within two hours of watchTowr’s October 6 write-up (BleepingComputer).
Exploitation phase: Rapid Escalation (since October 9, 2026)
Observation window used here: signal counts from October 7 to October 11, 2026 (5 full days). Unique IP addresses from October 7 to October 12, 2026, per the Live Exploit Tracker. Source profile: the 109 addresses CrowdSec CTI links to the CVE over the 30 days to October 12.

Key findings

Exploited within a day of the write-up: Atlassian published its advisory on Monday, October 5. watchTowr explained the bug on October 6, public exploit code followed the same day, and CrowdSec’s rule caught its first matching requests on October 7.
88% of the volume is one research scanner: Of 6,657 signals recorded between October 7 and 11, 5,853 came from addresses CrowdSec CTI classifies as benign, mainly 66 DigitalOcean addresses run by LeakIX, a company that indexes exposed services.
The remaining 43 addresses are the real story: Seven sit in one Indonesian network range and are already on the CrowdSec Community Blocklist. Four belong to an attacker group CrowdSec tracks. Twenty-four matched nothing but CVE-2026-21589.
One request, from a file read to admin: The attack is a single unauthenticated web request. watchTowr showed that reading crowd.properties gives an application password that can create a Jira administrator.

What is Atlassian Data Center, and who is exposed to CVE-2026-21589?

Atlassian Data Center is the self-hosted version of Jira, Confluence, Bitbucket, and their siblings. Companies that cannot or will not move to Atlassian Cloud run it: regulated industries, the public sector, large engineering teams. IT and engineering own it, and it is often internet-facing so staff and contractors can reach it. watchTowr counted just under 700,000 Confluence instances visible on one internet search engine alone.

Why CVE-2026-21589 matters: Jira and Confluence hold incident tickets, architecture diagrams, customer issues, and the runbooks where someone pasted a password. Bitbucket holds the source code. The file read itself only reaches the application folder, but one file in it, crowd.properties, stores the password Jira uses to talk to Atlassian’s user directory, Crowd. With it, watchTowr could create a user and add it to jira-administrators.

On the Live Exploit Tracker, 56% of targeted organizations are in commerce, and 34% are small offices and home offices. Targets sit mostly in Germany (35%), France (15%), the United States (11%), and South Africa (8%). This describes where CrowdSec has visibility, not where Atlassian is deployed.

How does CVE-2026-21589 work?

All these products share one library, atlassian-plugins-webresource, to serve images and scripts from URLs such as /download/resources/. Its router first removes ../ from the requested path, then converts :: into /. An attacker sends ..:: instead: it passes the check, then becomes ../ once converted, and enough of them climb out of the resource folder to files such as WEB-INF/web.xml. The root cause is that the path is cleaned before it is decoded, not after. Directory listing is not possible, but the files worth reading have the same names on every install.

Analysis by Sonny, Piotr Bazydło and Yordan Ganchev of watchTowr Labs: write-up (October 6, 2026)
Vendor advisory: Atlassian, CVE-2026-21589 · Tracking: JRASERVER-79546. Fixed in atlassian-plugins-webresource 6.0.8, shipped in the releases above.

One library across eight products is why a single bug lands everywhere. Attackers treat Atlassian flaws the same way: 69 of the 109 addresses linked to CVE-2026-21589 in CrowdSec CTI also probed CVE-2021-26086, a Jira file read from 2021.

What is the CrowdSec Network observing for CVE-2026-21589?

Between October 7 and October 11, 2026, the CrowdSec Network recorded 6,657 signals from machines reporting requests that match the CVE-2026-21589 exploitation pattern, detected by the CrowdSec scenario released on October 7, 2026. That averages 1,331 signals per day, peaking at 2,021 on Friday, October 9, when 842 machines in the network reported at least one matching request. The Live Exploit Tracker lists 89 unique IP addresses from October 7 to the morning of October 12, between 33 and 58 a day.

Most of that is LeakIX. It’s 66 addresses, all on DigitalOcean, each matched between 15 and 24 CVEs: a fleet checking the internet for many known flaws, now including this one. CrowdSec CTI classifies them as a known security company, and they produced 88% of the signals.

The other 43 addresses sent 804 signals over the five days, rising from 24 on October 7 to 302 on October 10, then dropping to 44 on Sunday. They fall into three groups:

Seven addresses in one Indonesian range (14.102.84.0/24, GSL Networks), all rated malicious and on the CrowdSec Community Blocklist. Each matched 7 to 9 CVEs, all including WordPress WP2Shell from Week 35; three also matched the WordPress flaw from Week 40, and two matched the 2022 Confluence remote code execution, CVE-2022-26134.
Four DigitalOcean addresses CrowdSec attributes to an attacker group it tracks as Quirky Greenyellow Shelduck. Each matched 15 to 19 CVEs, including the 2021 Jira file read (CVE-2021-26086), the SharePoint “ToolShell” vulnerability (CVE-2025-53770), and a FortiOS authentication bypass (CVE-2024-55591).
Twenty-four addresses matched only CVE-2026-21589, on residential networks in Vietnam, Korea, the UK, and Austria, and on small hosting providers. 22 of them are rated only “known” in CrowdSec CTI, not malicious.

The part worth flagging is that third group. Single-purpose sources with little history are the ones a reputation-based blocklist sees last, and they showed up within days of the advisory.

What this data does not show

A matching request is an exploitation attempt. CrowdSec cannot confirm any of them succeeded, or which file was returned.
89 unique IP addresses are not 89 threat actors. LeakIX alone accounts for 66 of the 109 addresses in CTI.
These counts come from traffic reaching machines participating in the CrowdSec Network: a sample, not a census.
The tracker (89 addresses, October 7 to 12) and CTI (109 addresses, 30 days) count over different windows and rules, so the totals differ.
Previdian saw attempts on October 6. CrowdSec’s data starts on October 7, so the first hours after the write-up may be undercounted.
Five days is short. One quiet Sunday is not a decline.

What defenders get wrong about CVE-2026-21589

The first mistake is reading the advisory’s caveat as comfort. “Exploitation requires prior knowledge of the target file’s exact name and path” sounds like a barrier. It is not: every install uses the same file layout, and the public templates already name the files. Every attacker has that knowledge.

The second is treating a file read as a data leak rather than an access problem. watchTowr’s chain goes from crowd.properties to a new Jira administrator. If an instance was reachable and unpatched after October 6, upgrading closes the hole but not what may have come through it: rotate the Crowd application password, and review the jira-administrators group and any accounts created since October 5.

The third is reading the chart. 6,657 signals and “Rapid Escalation” look like a mass campaign; 88% of it is a research scanner. That cuts both ways. Scanner traffic is not an attack, but it means internet-wide discovery of vulnerable instances is already done. The trade-off is honest: upgrading Jira or Confluence Data Center often means retesting Marketplace apps, which is why many teams lag. Atlassian’s workaround or a virtual patch can buy days, not quarters. If you still run Server, which Atlassian stopped supporting in February 2024, Atlassian’s own ticket says end-of-life versions may be affected; no fix is coming for them.

How do you protect Atlassian Data Center against CVE-2026-21589?

Patch. Upgrade each product to the fixed release for your branch or later (versions listed above, advisory). Confirm the version in the product’s System Information page, then run watchTowr’s Detection Artefact Generator against your own Jira, Confluence, or Bitbucket: a fixed instance does not return WEB-INF/web.xml. If you cannot patch this week, Atlassian documents a Tomcat RewriteValve rule (or a urlrewrite.xml rule for Bitbucket) that blocks the traversal.

Virtual patching with CrowdSec AppSec. The CrowdSec AppSec Component inspects HTTP requests before they reach Atlassian and blocks those matching crowdsecurity/vpatch-CVE-2026-21589: a decoded URL containing both /download/resources/ and ..::. That covers both the Jira and Confluence paths, and no legitimate request contains ..::.

sudo cscli collections install crowdsecurity/appsec-virtual-patching
sudo systemctl reload crowdsec
sudo cscli appsec-rules list | grep -i 'CVE-2026-21589'

A blocked request gets HTTP 403 from the remediation component and shows up in cscli alerts list.

Preemptive blocking. Subscribe to the CrowdSec Intelligence Blocklists to drop addresses already flagged across the network, such as the seven Indonesian addresses on the Community Blocklist. It is weaker against the 24 single-purpose addresses, most rated only “known”; hence the virtual patch. If you would rather not be catalogued at all, the Public Internet Scanners blocklist covers the LeakIX fleet.

Stay proactive. Follow CVE-2026-21589 on the Live Exploit Tracker and query its sources in CrowdSec CTI.

Frequently asked questions about CVE-2026-21589

Is CVE-2026-21589 being exploited in the wild? Yes, in attempts. Previdian saw honeypot hits on October 6, 2026, and the CrowdSec Network recorded 6,657 matching signals between October 7 and 11. Most came from a research scanner; 43 addresses were not. CISA has not listed it in KEV as of October 12.

Which Atlassian products are affected by CVE-2026-21589? The Data Center editions of Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo and Crowd, plus Crucible and Fisheye. First fixed releases include Jira Software 9.12.40, 10.3.26 and 11.3.12, Confluence 9.2.26 and 10.2.19, and Bitbucket 9.4.26, 10.2.8 and 10.5.1. Atlassian Cloud is patched.

Can I mitigate CVE-2026-21589 without upgrading? Partly. Atlassian’s RewriteValve workaround or the CrowdSec virtual patch blocks the known request pattern, and restricting internet access removes most of the exposure. The flaw stays until you upgrade, and neither undoes a read that already happened.

Related CrowdSec threat alerts

Written by Matthieu M., Data Team Lead, CrowdSec. Published October 12, 2026.

Sharing insights and taking swift action can collectively reduce the impact of these threats. This is your call to action for real-time threat intelligence and collaborative cybersecurity.