Cybersecurity
Attackers target Atlassian flaw within hours of disclosure
A newly disclosed Atlassian Data Center flaw was being probed within two hours of extra technical details, while Atlassian and researchers listed affected products, patches and temporary mitigations.
- Atlassian said CVE-2026-21589 affected Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye, and it listed fixes for each product.
- Atlassian said the flaw allowed an unauthenticated attacker to access specific files in the web application root if the exact filename and path were known.
- Atlassian advised customers to remove affected instances from the public internet and to use WAF, RewriteValve and urlrewrite.xml mitigations.
- Previdian said telemetry detected 15 exploitation attempts from three unique IP addresses in Japan and the United States.
- watchTowr said the attempts began two hours after its extra technical details were published, and it said the bug could expose tokens, credentials, keys and other authentication material.
Atlassian said it had issued fixes for Bitbucket Data Center 9.4.26, 10.2.8 and 10.5.1; Confluence Data Center 9.2.26 and 10.2.19; Jira Service Management Data Center 5.12.40, 10.3.26 and 11.3.12; Jira Software Data Center 9.12.40, 10.3.26 and 11.3.12; Bamboo Data Center 10.2.24 and 12.1.12; Crowd Data Center 6.3.7, 7.0.3, 7.1.7 and 7.2.4; Crucible 4.9.15; and Fisheye 4.9.15. It also said affected Atlassian Cloud products had already been patched.
The company said the flaw let an unauthenticated attacker reach specific files under the web application root if the attacker knew the exact name and path. It said the issue did not allow directory listing, and it advised customers to move instances off the public internet, add a WAF rule, use Tomcat's RewriteValve for some products and update urlrewrite.xml for Bitbucket.
Previdian said telemetry found 15 attempts from three unique IP addresses in Japan and the United States. Ryan Dewhurst said those attempts reached its honeypot network within two hours of watchTowr's extra technical publication.
watchTowr said the root cause was Atlassian web-resource handling that could turn a crafted path into access to files elsewhere in the application. It said that could expose tokens, credentials, keys or other authentication material, and that a Nuclei template would make automated scanning easier.
Named in this story
People
- Ryan Dewhurst
- said the attempts hit its honeypot network and warned activity could rise
Companies
- Atlassian
- said the flaw affected its products and issued fixes and mitigations
- watchTowr
- released additional technical details about the flaw
- Previdian
- said telemetry detected exploitation attempts
Products and systems
- Bitbucket Data Center
- one affected product with fixes listed
- Confluence Data Center
- one affected product with fixes listed
- Jira Service Management Data Center
- one affected product with fixes listed
- Jira Software Data Center
- one affected product with fixes listed
- Bamboo Data Center
- one affected product with fixes listed
- Crowd Data Center
- one affected product with fixes listed
- Crucible
- one affected product with fixes listed
- Fisheye
- one affected product with fixes listed
- Tomcat
- its RewriteValve was named in a mitigation recommendation
- Nuclei
- had a template release said to make automated scanning easier
Places
- Japan
- one of the countries where the source IPs were located
- United States
- the other country where the source IPs were located
How the source tells it
The piece is a technical security report, with urgency supplied by the rapid exploitation timeline and repeated calls to patch immediately.
- urgency the short gap between disclosure and observed probing, reinforced by immediate patching advice