Atlassian flaw exploited after public proof of concept

Attackers are attempting to exploit a critical Atlassian file-access vulnerability after researchers published a technical report and public proof of concept. Security company Previdian detected attempts on its honeypot network within two hours of the publication, according to the company.

The flaw, tracked as CVE-2026-21589, affects self-hosted instances across eight Atlassian product families, including Jira, Confluence, and Bitbucket. It allows unauthenticated attackers who know a file’s exact name and path to access certain files in an application’s web root.

Researchers at watchTowr confirmed file reads in Jira, Confluence, and Bitbucket. In certain deployments integrated with Atlassian Crowd, attackers could use credentials exposed in a configuration file to create a Jira administrator account, provided Crowd is reachable and the application has sufficient permissions. The researchers said restricting which IP addresses can reach Crowd would make exploitation more difficult.

Previdian said it observed attempts from three IP addresses and expects activity to rise as public exploit details and an automated Nuclei scanning template become available. Its Ryan Dewhurst told BleepingComputer the honeypot activity began within two hours of watchTowr’s research and proof of concept.

Atlassian advised administrators of self-hosted instances to apply security updates promptly. Recommended mitigations include restricting external network access and using firewall, proxy, or URL rewrite rules to block traversal patterns. watchTowr has also released a scanner to help administrators check whether their instances are vulnerable.