Jira and Confluence flaw that lets anyone read your files without a password is now being exploited

It took about two hours. On October 6, security firm watchTowr published a technical analysis of a flaw Atlassian had just disclosed, along with proof-of-concept code. According to BleepingComputer, the honeypots Previdian runs on the Internet recorded the first exploitation attempts within two hours.

On October 15, the US cybersecurity agency (CISA) added this flaw, CVE-2026-21589, to its catalog of actively exploited vulnerabilities. It affects the self-hosted ("Data Center") versions of eight Atlassian products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye. Atlassian rates it 9.3 out of 10, a critical severity.

Reading server files without logging in

According to Atlassian's advisory published on October 5, an attacker with no account at all can read certain files located in the web application's directory. They must know the exact file name and path, because the flaw does not allow listing the contents of folders. The vendor warns that, in some configurations, sensitive files stored there could increase the risk.

watchTowr showed which ones. In installations where Jira relies on Crowd, Atlassian's authentication tool, a configuration file contains credentials in clear text. According to the researchers, these credentials could be used to create a Jira administrator account, provided that Crowd is reachable and the application's permissions allow it. They add that filtering the IP addresses allowed to contact Crowd makes the attack significantly harder.

A vendor advisory left without an update

The versions hosted by Atlassian (Cloud) have already been patched, and the vendor found no sign of exploitation there. For Data Center installations, it says it cannot confirm whether its customers' servers have been affected. Its advisory, last modified on October 5, mentions neither the exploitation nor the addition to CISA's catalog. Yet that last piece of information is what should set your timeline.

What to do

What attackers collect here are configuration secrets. Patching is therefore not enough if an exposed server remained vulnerable for several days.

• Update to a fixed version: Jira Software 9.12.40, 10.3.26 or 11.3.12; Jira Service Management 5.12.40, 10.3.26 or 11.3.12; Confluence 9.2.26 or 10.2.19; Bitbucket 9.4.26, 10.2.8 or 10.5.1; Bamboo 10.2.24 or 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7 or 7.2.4; Crucible and Fisheye 4.9.15. All earlier versions are affected.
• In the meantime, take the instance off the Internet or restrict access to it. Atlassian also provides a filtering rule for web application firewalls or proxies, Tomcat RewriteValve rules (Jira, Confluence, Bamboo, Crowd) and a URL rewrite rule for Bitbucket, to be applied on each node.
• Look for traces in access logs: Atlassian advises looking for .. sequences next to /, \\ or ::, both before and after URL decoding.
• If in doubt, change the passwords and secrets stored in configuration files, starting with the account that links Jira to Crowd.

As with the critical GitLab flaw patched on October 12, in-house development tools are prime targets: they hold code, tickets and access. One question remains: who is exploiting the flaw, and against whom? Neither CISA nor Atlassian has said so far.