CVE-2026-21589 Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

1. Executive summary

CVE-2026-21589 is a critical unauthenticated arbitrary file access flaw in eight self-hosted Atlassian Data Center products (Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, Fisheye), rated CVSS 9.3 and classified CWE-552. It is listed in CISA KEV with an exploitation-added date of 2026-10-15 and a remediation due date of 2026-10-18, and public proof-of-concept tooling plus honeypot-observed scanning appeared within roughly two days of the October 5 disclosure. Any EMEA financial services firm running an internet-facing Atlassian Data Center instance is exposed to unauthenticated file read of known paths inside the web application root, and in a Crowd deployment that also runs Jira, that read can expose credentials sufficient to create an administrative account. The window to act is the KEV due date, not the next patch cycle.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed steps, from the vendor advisory and the public technical analysis:

1. An unauthenticated remote attacker identifies an internet-reachable Atlassian Data Center instance running an affected version.
2. The attacker supplies a request to the web-resource download endpoint containing a crafted path. Atlassian products replace slashes with the double-colon sequence :: as an escaping measure; during request processing those :: sequences can be translated back to path separators, so traversal components reach the resource-loading code.
3. The attacker must know the exact filename and path. The flaw does not provide directory listing or enumeration.
4. The contents of the requested file are returned to the attacker. Traversal is bounded by the Tomcat context: watchTowr's testing could not read outside the application web root, but could read files throughout it. /etc/passwd does not work; WEB-INF/web.xml does, because Tomcat requires it.
5. In a Crowd deployment with Jira configured, reading WEB-INF/classes/crowd.properties exposed application credentials. With network access to Crowd, those credentials were used to create a user and add it to jira-administrators. Crowd's IP allowlisting can block this route.

The mechanism is a path traversal in Atlassian's web-resource handling, reached through the :: separator behaviour. NVD records CWE-552 (files or directories accessible to external parties); the public technical analysis describes the same flaw as a path traversal. Both classifications describe the same defect.

Affected products and fixed versions, from the October 5 Atlassian advisory:

All versions before the applicable fixed release are affected, including unsupported versions. Atlassian Cloud products were patched by Atlassian and require no customer action.

Observed exploitation. SANS ISC honeypots recorded exploit attempts from October 6 using the exact URLs published in the watchTowr write-up, including:

/download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml
/s/1.0/_/download/resources/com.atlassian.bitbucket.server.bitbucket-webpack-INTERNAL:avatar/avatar/..::..::..::..::..::WEB-INF::urlrewrite.xml
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::WEB-INF::web.xml

SANS assesses the scans as the work of a single actor on the timing and targeting, with all source IPs associated with Digital Ocean. That attribution is single-sourced and rests on honeypot telemetry; treat it as a lead, not a confirmed actor. No MITRE ATT&CK profile is available for any named actor in this item, so no attribution is confirmed.

Public tooling. A Python file-read proof-of-concept and a Nuclei template are public for Jira, Confluence and Bitbucket. Detailed technical analysis and file-read PoC scripts are public, which is why Rapid7 recommends emergency patching outside normal cycles.

4. Mitigation & containment

P1 (within 24 hours)

• Patch every affected Data Center instance to the fixed version in the table above, or to the latest available release. Given the KEV due date of 2026-10-18 and observed exploitation, treat this as emergency change, not scheduled maintenance.
• Where patching cannot happen inside 24 hours, remove the instance from the internet or restrict it from external network access. Atlassian's guidance is explicit that this applies to instances with user authentication as well.
• Apply the vendor-supplied interim mitigations only as a stopgap: the Web Application Firewall or proxy rule for all affected products, the Tomcat RewriteValve mitigation for Confluence, Jira Service Management, Jira Software, Bamboo and Crowd, and the separate urlrewrite.xml rule for Bitbucket. These are limited and are not replacements for patching.
• For Crowd deployments that also run Jira, check Crowd IP allowlisting. It blocks the credential-reuse route to jira-administrators even when crowd.properties has been read.

P2 (within 72 hours)

• Hunt access logs for exploitation, including on instances already patched. URL-decode each request line up to twice, then search for .. immediately adjacent to /, \, or ::. The vendor-supplied regex for raw logs is: (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*
• If investigation shows access to protected configuration files, rotate the exposed credentials and secrets after containing the affected systems. In the demonstrated chain that means Crowd application credentials and any Jira administrative accounts created with them.
• Review Crowd and Jira administrative account creation for the period since October 5, and check for accounts added to jira-administrators that were not provisioned through change control.

P3 (within 7 days)

• Inventory the Atlassian Data Center estate and record which instances are internet-facing, which are unsupported versions, and which have Crowd co-deployed with Jira. Unsupported versions are affected and will not receive a fix.
• Confirm that the WAF or proxy rules are still in place on any instance that could not be patched, and set a date to remove them once patching completes.

5. Indicators of compromise

The IP set is single-sourced from SANS ISC honeypot telemetry and is hosted on Digital Ocean, a shared provider. Do not block the range; verify against your own logs before enforcement.

ipv4  134.199.229[.]190
ipv4  134.199.230[.]82
ipv4  137.184.112[.]247
ipv4  137.184.33[.]84
ipv4  143.198.103[.]58
ipv4  143.198.132[.]93
ipv4  146.190.169[.]1
ipv4  146.190.172[.]250
ipv4  159.223.199[.]218
ipv4  164.92.68[.]152
ipv4  209.38.147[.]216
ipv4  24.199.101[.]184
ipv4  64.23.172[.]129
url  hxxps://<host>/download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml
url  hxxps://<host>/s/1.0/_/download/resources/com.atlassian.bitbucket.server.bitbucket-webpack-INTERNAL:avatar/avatar/..::..::..::..::..::WEB-INF::urlrewrite.xml
url  hxxps://<host>/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::WEB-INF::web.xml

Behavioural indicators

6. Detection

The traversal marker is the artefact: :: sequences adjacent to .. in a resource download request. The Sigma rule below matches on the request path as it appears in a web access log, so the strings are exact and not defanged.

title: Atlassian Data Center CVE-2026-21589 Path Traversal Attempt
id: 8f3c1a72-5d4e-4b91-9c2a-7e6b0d4f1a35
status: experimental
description: Detects requests to Atlassian Data Center resource download endpoints containing double-colon traversal sequences used by CVE-2026-21589.
author: Adverse Trace
date: 2026/10/15
references:

  - https://nvd.nist.gov/vuln/detail/CVE-2026-21589
  - https://www.rapid7.com/blog/post/etr-cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:

      - '..::'
      - '::..'
      - '..%3a%3a'
      - '%2e%2e::'
  selection_endpoint:
    cs-uri-stem|contains:

      - '/download/resources/'
      - '/_/download/resources/'
  condition: selection_path and selection_endpoint
falsepositives:

  - Legitimate Atlassian resource paths that contain a double colon but no traversal component. Tune by requiring the traversal selection.
level: high

rule ATLASSIAN_CVE_2026_21589_Traversal_Request
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-21589"
        description = "Matches HTTP request lines carrying the double-colon traversal sequences used against Atlassian Data Center resource download endpoints in CVE-2026-21589."
    strings:
        $a = "..::..::" ascii
        $b = "WEB-INF::web.xml" ascii
        $c = "WEB-INF::urlrewrite.xml" ascii
        $d = "WEB-INF::classes::crowd.properties" ascii
        $e = "/download/resources/" ascii
        $f = "/_/download/resources/" ascii
    condition:
        any of ($a, $b, $c, $d) and any of ($e, $f)
}

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• NVD, CVE-2026-21589 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-21589, published 2026-10-14.
• Rapid7, CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products, https://www.rapid7.com/blog/post/etr-cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products, 2026-10-06.
• SANS Internet Storm Center, Scans for Atlassian vulnerability (CVE-2026-21589), https://isc.sans.edu/diary/rss/33406, 2026-10-07.
• The Register, Atlassian warns of critical file access flaw in its datacenter products, https://www.theregister.com/security/2026/10/06/atlassian-warns-of-critical-file-access-flaw-in-its-datacenter-products/5301284, 2026-10-06.
• Help Net Security, Atlassian urges immediate patching of critical Data Center file access vulnerability (CVE-2026-21589), https://www.helpnetsecurity.com/2026/10/06/atlassian-data-center-cve-2026-21589/, 2026-10-06.
• The Hacker News, Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products, https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html, 2026-10.
• The Hacker News, Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details, https://thehackernews.com/2026/10/atlassian-data-center-flaw-draws.html, 2026-10.

8. Adverse Trace position

CVE-2026-21589 is CVSS 9.3 critical, is in CISA KEV with a 2026-10-18 remediation due date, and has public proof-of-concept tooling plus honeypot-observed scanning within two days of disclosure. The exploitation-attempt IP set and the single-actor assessment are single-sourced from SANS ISC honeypot telemetry and should be verified against client logs before any blocking decision. The Crowd-plus-Jira credential chain is demonstrated in watchTowr testing and is the highest-impact outcome for a financial services client, because it converts an unauthenticated file read into administrative access to Jira. Adverse Trace assesses that any internet-facing Atlassian Data Center instance in the EMEA client base should be treated as exposed until it is confirmed on a fixed version. We will re-check KEV status and vendor guidance daily through the 2026-10-18 due date, and will issue a follow-up if exploitation is confirmed against a financial services target or if Atlassian revises the fixed-version list.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.