> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-21589 Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-21589-atlassian-multiple-products-atlassian-multiple-products-files-or-directories-accessible-to-external-parties-vulnerability/ - Published: 2026-10-15T22:57:11.000Z - Updated: 2026-10-15T22:57:11.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-21589 ## 1\. Executive summary CVE-2026-21589 is a critical unauthenticated arbitrary file access flaw in eight self-hosted Atlassian Data Center products (Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, Fisheye), rated CVSS 9.3 and classified CWE-552\. It is listed in CISA KEV with an exploitation-added date of 2026-10-15 and a remediation due date of 2026-10-18, and public proof-of-concept tooling plus honeypot-observed scanning appeared within roughly two days of the October 5 disclosure. Any EMEA financial services firm running an internet-facing Atlassian Data Center instance is exposed to unauthenticated file read of known paths inside the web application root, and in a Crowd deployment that also runs Jira, that read can expose credentials sufficient to create an administrative account. The window to act is the KEV due date, not the next patch cycle. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | The flaw permits unauthenticated read of configuration files in the web application root, and the Crowd-plus-Jira chain reaches credential theft and account creation. | The incident management process must cover detection, containment and post-incident review for a file-read event, not only for a service outage. | | DORA Art. 19 | CISA KEV lists CVE-2026-21589 with a 2026-10-18 remediation due date, and exploitation attempts are already observed in the wild. | If a client instance is confirmed compromised, the major-incident reporting clock to the competent authority is engaged; the KEV due date is the internal deadline, not the reporting deadline. | | NIS2 Art. 21(2)(d) | The exposure sits in a self-hosted third-party collaboration platform that many firms treat as an internal dependency. | Supply chain security measures must extend to the Atlassian Data Center estate, including inventory of which instances are internet-facing. | ## 3\. Technical analysis & attack chain Confirmed steps, from the vendor advisory and the public technical analysis: 1. An unauthenticated remote attacker identifies an internet-reachable Atlassian Data Center instance running an affected version. 2. The attacker supplies a request to the web-resource download endpoint containing a crafted path. Atlassian products replace slashes with the double-colon sequence `::` as an escaping measure; during request processing those `::` sequences can be translated back to path separators, so traversal components reach the resource-loading code. 3. The attacker must know the exact filename and path. The flaw does not provide directory listing or enumeration. 4. The contents of the requested file are returned to the attacker. Traversal is bounded by the Tomcat context: watchTowr's testing could not read outside the application web root, but could read files throughout it. `/etc/passwd` does not work; `WEB-INF/web.xml` does, because Tomcat requires it. 5. In a Crowd deployment with Jira configured, reading `WEB-INF/classes/crowd.properties` exposed application credentials. With network access to Crowd, those credentials were used to create a user and add it to `jira-administrators`. Crowd's IP allowlisting can block this route. The mechanism is a path traversal in Atlassian's web-resource handling, reached through the `::` separator behaviour. NVD records CWE-552 (files or directories accessible to external parties); the public technical analysis describes the same flaw as a path traversal. Both classifications describe the same defect. Affected products and fixed versions, from the October 5 Atlassian advisory: | Product | Fixed versions | | ----------------------------------- | -------------------------- | | Bitbucket Data Center | 9.4.26, 10.2.8, 10.5.1 | | Confluence Data Center | 9.2.26, 10.2.19 | | Jira Service Management Data Center | 5.12.40, 10.3.26, 11.3.12 | | Jira Software Data Center | 9.12.40, 10.3.26, 11.3.12 | | Bamboo Data Center | 10.2.24, 12.1.12 | | Crowd Data Center | 6.3.7, 7.0.3, 7.1.7, 7.2.4 | | Crucible | 4.9.15 | | Fisheye | 4.9.15 | All versions before the applicable fixed release are affected, including unsupported versions. Atlassian Cloud products were patched by Atlassian and require no customer action. Observed exploitation. SANS ISC honeypots recorded exploit attempts from October 6 using the exact URLs published in the watchTowr write-up, including: ``` /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml /s/1.0/_/download/resources/com.atlassian.bitbucket.server.bitbucket-webpack-INTERNAL:avatar/avatar/..::..::..::..::..::WEB-INF::urlrewrite.xml /s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::WEB-INF::web.xml ``` SANS assesses the scans as the work of a single actor on the timing and targeting, with all source IPs associated with Digital Ocean. That attribution is single-sourced and rests on honeypot telemetry; treat it as a lead, not a confirmed actor. No MITRE ATT&CK profile is available for any named actor in this item, so no attribution is confirmed. Public tooling. A Python file-read proof-of-concept and a Nuclei template are public for Jira, Confluence and Bitbucket. Detailed technical analysis and file-read PoC scripts are public, which is why Rapid7 recommends emergency patching outside normal cycles. ## 4\. Mitigation & containment P1 (within 24 hours) - Patch every affected Data Center instance to the fixed version in the table above, or to the latest available release. Given the KEV due date of 2026-10-18 and observed exploitation, treat this as emergency change, not scheduled maintenance. - Where patching cannot happen inside 24 hours, remove the instance from the internet or restrict it from external network access. Atlassian's guidance is explicit that this applies to instances with user authentication as well. - Apply the vendor-supplied interim mitigations only as a stopgap: the Web Application Firewall or proxy rule for all affected products, the Tomcat RewriteValve mitigation for Confluence, Jira Service Management, Jira Software, Bamboo and Crowd, and the separate `urlrewrite.xml` rule for Bitbucket. These are limited and are not replacements for patching. - For Crowd deployments that also run Jira, check Crowd IP allowlisting. It blocks the credential-reuse route to `jira-administrators` even when `crowd.properties` has been read. P2 (within 72 hours) - Hunt access logs for exploitation, including on instances already patched. URL-decode each request line up to twice, then search for `..` immediately adjacent to `/`, `\`, or `::`. The vendor-supplied regex for raw logs is: `(?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*` - If investigation shows access to protected configuration files, rotate the exposed credentials and secrets after containing the affected systems. In the demonstrated chain that means Crowd application credentials and any Jira administrative accounts created with them. - Review Crowd and Jira administrative account creation for the period since October 5, and check for accounts added to `jira-administrators` that were not provisioned through change control. P3 (within 7 days) - Inventory the Atlassian Data Center estate and record which instances are internet-facing, which are unsupported versions, and which have Crowd co-deployed with Jira. Unsupported versions are affected and will not receive a fix. - Confirm that the WAF or proxy rules are still in place on any instance that could not be patched, and set a date to remove them once patching completes. ## 5\. Indicators of compromise | type | value | confidence | source | | ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | ------------------- | | ipv4 | 134.199.229\[.\]190 | low, single-sourced honeypot telemetry | SANS ISC | | ipv4 | 134.199.230\[.\]82 | low, single-sourced honeypot telemetry | SANS ISC | | ipv4 | 137.184.112\[.\]247 | low, single-sourced honeypot telemetry | SANS ISC | | ipv4 | 137.184.33\[.\]84 | low, single-sourced honeypot telemetry | SANS ISC | | ipv4 | 143.198.103\[.\]58 | low, single-sourced honeypot telemetry | SANS ISC | | ipv4 | 143.198.132\[.\]93 | low, single-sourced honeypot telemetry | SANS ISC | | ipv4 | 146.190.169\[.\]1 | low, single-sourced honeypot telemetry | SANS ISC | | ipv4 | 146.190.172\[.\]250 | low, single-sourced honeypot telemetry | SANS ISC | | ipv4 | 159.223.199\[.\]218 | low, single-sourced honeypot telemetry | SANS ISC | | ipv4 | 164.92.68\[.\]152 | low, single-sourced honeypot telemetry | SANS ISC | | ipv4 | 209.38.147\[.\]216 | low, single-sourced honeypot telemetry | SANS ISC | | ipv4 | 24.199.101\[.\]184 | low, single-sourced honeypot telemetry | SANS ISC | | ipv4 | 64.23.172\[.\]129 | low, single-sourced honeypot telemetry | SANS ISC | | url | hxxps:///download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml | medium, matches published PoC | SANS ISC, watchTowr | | url | hxxps:///s/1.0/\_/download/resources/com.atlassian.bitbucket.server.bitbucket-webpack-INTERNAL:avatar/avatar/..::..::..::..::..::WEB-INF::urlrewrite.xml | medium, matches published PoC | SANS ISC, watchTowr | | url | hxxps:///s/1/\_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::WEB-INF::web.xml | medium, matches published PoC | SANS ISC, watchTowr | The IP set is single-sourced from SANS ISC honeypot telemetry and is hosted on Digital Ocean, a shared provider. Do not block the range; verify against your own logs before enforcement. ```iocs ipv4 134.199.229[.]190 ipv4 134.199.230[.]82 ipv4 137.184.112[.]247 ipv4 137.184.33[.]84 ipv4 143.198.103[.]58 ipv4 143.198.132[.]93 ipv4 146.190.169[.]1 ipv4 146.190.172[.]250 ipv4 159.223.199[.]218 ipv4 164.92.68[.]152 ipv4 209.38.147[.]216 ipv4 24.199.101[.]184 ipv4 64.23.172[.]129 url hxxps:///download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml url hxxps:///s/1.0/_/download/resources/com.atlassian.bitbucket.server.bitbucket-webpack-INTERNAL:avatar/avatar/..::..::..::..::..::WEB-INF::urlrewrite.xml url hxxps:///s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::WEB-INF::web.xml ``` Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------- | ------------------------------- | ----------------------------------------- | | Requests to /download/resources/ or /s/1/\_/download/resources/ containing :: adjacent to .. | Atlassian access logs, WAF logs | high, matches published PoC | | Requests for WEB-INF/web.xml or WEB-INF/urlrewrite.xml via the resource download path | Atlassian access logs | high, matches published PoC | | New user created in Crowd and added to jira-administrators outside change control | Crowd and Jira audit logs | medium, demonstrated in watchTowr testing | | Reads of WEB-INF/classes/crowd.properties | Atlassian access logs | medium, demonstrated in watchTowr testing | ## 6\. Detection The traversal marker is the artefact: `::` sequences adjacent to `..` in a resource download request. The Sigma rule below matches on the request path as it appears in a web access log, so the strings are exact and not defanged. ```yaml title: Atlassian Data Center CVE-2026-21589 Path Traversal Attempt id: 8f3c1a72-5d4e-4b91-9c2a-7e6b0d4f1a35 status: experimental description: Detects requests to Atlassian Data Center resource download endpoints containing double-colon traversal sequences used by CVE-2026-21589. author: Adverse Trace date: 2026/10/15 references: - https://nvd.nist.gov/vuln/detail/CVE-2026-21589 - https://www.rapid7.com/blog/post/etr-cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products logsource: category: webserver detection: selection_path: cs-uri-stem|contains: - '..::' - '::..' - '..%3a%3a' - '%2e%2e::' selection_endpoint: cs-uri-stem|contains: - '/download/resources/' - '/_/download/resources/' condition: selection_path and selection_endpoint falsepositives: - Legitimate Atlassian resource paths that contain a double colon but no traversal component. Tune by requiring the traversal selection. level: high ``` ```yara rule ATLASSIAN_CVE_2026_21589_Traversal_Request { meta: author = "Adverse Trace" date = "2026-10-15" reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-21589" description = "Matches HTTP request lines carrying the double-colon traversal sequences used against Atlassian Data Center resource download endpoints in CVE-2026-21589." strings: $a = "..::..::" ascii $b = "WEB-INF::web.xml" ascii $c = "WEB-INF::urlrewrite.xml" ascii $d = "WEB-INF::classes::crowd.properties" ascii $e = "/download/resources/" ascii $f = "/_/download/resources/" ascii condition: any of ($a, $b, $c, $d) and any of ($e, $f) } ``` ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-21589](https://nvd.nist.gov/vuln/detail/CVE-2026-21589?ref=f4n6.co.uk) | 9.3 Critical | ⚠ KEV 2026-10-15 | 3% | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Da… | ## 7\. Sources - NVD, CVE-2026-21589 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-21589, published 2026-10-14. - Rapid7, CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products, https://www.rapid7.com/blog/post/etr-cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products, 2026-10-06. - SANS Internet Storm Center, Scans for Atlassian vulnerability (CVE-2026-21589), https://isc.sans.edu/diary/rss/33406, 2026-10-07. - The Register, Atlassian warns of critical file access flaw in its datacenter products, https://www.theregister.com/security/2026/10/06/atlassian-warns-of-critical-file-access-flaw-in-its-datacenter-products/5301284, 2026-10-06. - Help Net Security, Atlassian urges immediate patching of critical Data Center file access vulnerability (CVE-2026-21589), https://www.helpnetsecurity.com/2026/10/06/atlassian-data-center-cve-2026-21589/, 2026-10-06. - The Hacker News, Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products, https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html, 2026-10. - The Hacker News, Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details, https://thehackernews.com/2026/10/atlassian-data-center-flaw-draws.html, 2026-10. ## 8\. Adverse Trace position CVE-2026-21589 is CVSS 9.3 critical, is in CISA KEV with a 2026-10-18 remediation due date, and has public proof-of-concept tooling plus honeypot-observed scanning within two days of disclosure. The exploitation-attempt IP set and the single-actor assessment are single-sourced from SANS ISC honeypot telemetry and should be verified against client logs before any blocking decision. The Crowd-plus-Jira credential chain is demonstrated in watchTowr testing and is the highest-impact outcome for a financial services client, because it converts an unauthenticated file read into administrative access to Jira. Adverse Trace assesses that any internet-facing Atlassian Data Center instance in the EMEA client base should be treated as exposed until it is confirmed on a fixed version. We will re-check KEV status and vendor guidance daily through the 2026-10-18 due date, and will issue a follow-up if exploitation is confirmed against a financial services target or if Atlassian revises the fixed-version list. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-21589?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*