Attackers Target Critical Atlassian Data Center File-Access Flaw CVE-2026-21589
Summary
Attackers are attempting to exploit CVE-2026-21589, a critical file-access flaw in Atlassian Data Center products. The flaw can expose sensitive files; Atlassian urges customers to patch, restrict internet access, and review logs.
Key points
- Exploit attempts have reached honeypots, according to threat intelligence vendor Previdian.
- The flaw affects Atlassian Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye Data Center products.
- Path traversal can expose files within an affected application’s root directory; exploitation requires knowing the target file’s exact name and path.
- In some Crowd deployments, exposed plaintext credentials could let attackers create accounts and add them to administrator groups.
- Atlassian advises upgrading to a fixed version; until then, remove vulnerable instances from the internet or block external access.
- Atlassian also recommends reviewing access logs for indicators of compromise.
Article Details
- Vulnerability Types
- Arbitrary file access
- Path traversal
- Severity
- Critical
- Affected Versions
- All versions of the affected products
- Exploitation Status
- active
- Exploit Availability
- claimed_or_private
- Patch Status
- available
- Workarounds
- Remove vulnerable instances from the internet until they can be upgraded.
- Block access to vulnerable instances from external networks.
MITRE ATT&CK
CVE
Vendors
AtlassianAttackers have begun exploiting CVE-2026-21589, a critical arbitrary file access flaw in Atlassian Data Center products, shortly after patches and technical analysis were released.Previdian“Exploitation attempts have now started to hit our honeypot network,” threat intelligence vendor Previdian warned late Tuesday, and shared a list of attacker IPs.
Products
Bamboo Data CenterCenter, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye.Bitbucket Data CenterCVE-2026-21589 affects all versions of Atlassian’s Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible andConfluence Data CenterCVE-2026-21589 affects all versions of Atlassian’s Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible andCrowd Data CenterData Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye.CrucibleThe flaw affects multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye.FisheyeThe flaw affects multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye.Jira Service Management Data Centeraffects all versions of Atlassian’s Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye.Jira Software Data CenterAtlassian’s Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye.