CVE-2026-21589 (CVSS 9.3, EPSS ≥ 78th percentile) is a critical arbitrary file access vulnerability classified as CWE-552. It affects multiple Atlassian products, including Jira Service Management Data Center, Jira Software Data Center, Confluence Data Center, Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Every version of these products that has not received the security fix remains vulnerable.
Under specific circumstances, the vulnerability can also facilitate administrator account takeover in environments using Crowd Single Sign-On (SSO). CVE-2026-21589 has been identified as actively exploited in the wild. However, as of October 13, 2026, it had not been included in CISA’s Known Exploited Vulnerabilities (KEV) catalog.
A comprehensive technical investigation describes the complete exploitation process, including a scenario resulting in the takeover of a Jira administrator account. Public proof-of-concept (PoC) exploits demonstrate both unauthorized file retrieval and the complete account takeover sequence. Several national Computer Emergency Response Teams (CERTs) have also published security warnings concerning this vulnerability.
Risk Assessment of CVE-2026-21589 for Atlassian Data Center Environments
Atlassian Data Center solutions are enterprise applications deployed and managed within an organization’s own infrastructure. These platforms support essential business operations, including project management, documentation, build automation, identity administration, and code review. Consequently, CVE-2026-21589 introduces significant security exposure across numerous business-critical processes.
Atlassian software has also been targeted in previous campaigns conducted by ransomware operators and Advanced Persistent Threat (APT) groups. The CISA KEV catalog contains 13 entries associated with Atlassian products. Eight of these entries have been marked as linked to ransomware activity.
Exploitation of CVE-2026-21589 enables an unauthenticated threat actor to retrieve files located within the web application’s root directory. In configurations that use Crowd SSO, the same weakness may additionally allow unauthorized account creation and the assignment of administrative permissions. A successful sequence of these actions can ultimately provide administrator-level access to the affected environment.
The associated risk is further amplified by confirmed exploitation activity, publicly documented technical details, and the availability of working PoC exploits.
Technical Analysis of CVE-2026-21589 in Atlassian Data Center Products
- CVSS 9.3 – Critical
- EPSS: 1.8% (78th percentile)
- Active Exploitation
- Public PoC Available
The CVE-2026-21589 vulnerability (CVSS 9.3, EPSS ≥ 78th percentile) permits unauthorized access to files within the web application root directory without requiring authentication. Classified under CWE-552, the flaw can be exploited only when the attacker already possesses the precise name and path of the targeted file. It does not provide the ability to browse directories or enumerate their contents.
In environments integrated with Crowd SSO, the impact may extend beyond information disclosure. If Crowd has sufficient permissions to create user accounts and change group memberships, exploitation can lead to the creation of unauthorized accounts and subsequent administrator account takeover.
The underlying issue resides in the Atlassian Web Resource Plugin, specifically in the processing of resource paths by the atlassian-plugins-webresource library. Within this component, the Router.unescapeSlashes() function interprets double-colon sequences (::) as forward slashes (/). This behavior enables the construction of directory traversal payloads capable of circumventing existing path restrictions.
An unauthenticated attacker can exploit this behavior by sending specially crafted HTTP requests to web resource endpoints. The application’s resource delivery mechanism may then expose files that would otherwise be inaccessible within the webroot directory structure. Potential targets include sensitive configuration files stored in the WEB-INF directory.
Jira deployments connected to Atlassian Crowd may contain a particularly sensitive configuration file: WEB-INF/classes/crowd.properties. This file stores the Crowd application name, the application password in plaintext, and the URL of the Crowd server.
If these credentials are exposed and the Crowd server is reachable, an attacker may use them to authenticate through the Crowd REST API. This access can enable the enumeration of existing users, registration of new accounts, and modification of user group memberships.
During their research, watchTowr Labs demonstrated this scenario by creating a Crowd user account and assigning it to the jira-administrators group. The resulting privileges provided administrative control over Jira.
However, successful execution of this attack chain requires several conditions: an active Crowd integration, access to the relevant credentials, and network connectivity to the Crowd service. Strictly configured Crowd IP allowlists can reduce the feasibility of this exploitation scenario.
Affected Atlassian Products and Recommended Mitigations
CVE-2026-21589 impacts Jira Service Management Data Center, Jira Software Data Center, Confluence Data Center, Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Versions released before the corresponding security fixes remain susceptible to exploitation.
Affected installations require urgent updates, with the highest priority assigned to systems accessible from the internet.
Atlassian has published web application firewall (WAF) rules intended to mitigate exploitation across every affected product. Additional product-specific measures are also available. These include Tomcat RewriteValve rules for Confluence, Jira Service Management, Jira Software, Bamboo, and Crowd. For Bitbucket, the recommended configuration involves adding a rule to the urlrewrite.xml file.
These vendor-supplied workarounds provide only temporary protection and do not replace the installation of security updates.
The following table identifies the fixed versions for each affected product.
| Product | Fixed versions |
| Jira Service Management Data Center | 5.12.40, 10.3.26, 11.3.12 |
| Jira Software Data Center | 9.12.40, 10.3.26, 11.3.12 |
| Confluence Data Center | 9.2.26, 10.2.19 |
| Bitbucket Data Center | 9.4.26, 10.2.8, 10.5.1 |
| Bamboo Data Center | 10.2.24, 12.1.12 |
| Crowd Data Center | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Crucible | 4.9.15 |
| Fisheye | 4.9.15 |
Summary
CVE-2026-21589 represents a critical security vulnerability that is being actively exploited and affects multiple Atlassian Data Center applications running without the required security updates. The flaw permits unauthenticated access to specific files within the web application root directory, provided that their exact names and paths are known beforehand.
In deployments where Crowd SSO is configured, exploitation may also progress to administrator account compromise under certain conditions. Immediate security measures should therefore include restricting access to internet-facing installations and urgently upgrading affected products to patched releases.
Greenbone’s OPENVAS SCAN Enterprise solution demonstrates high effectiveness in detecting perimeter vulnerabilities using both network scanning and authenticated host-level scanning.
Following the public disclosure of CVE-2026-21589, the OPENVAS ENTERPRISE FEED promptly incorporated vulnerability detection capabilities covering all affected Atlassian products. The available detection methods vary by product:
- Atlassian Jira Service Management Data Center: Remote banner check.
- Atlassian Jira Software Data Center: Active check and remote banner check.
- Atlassian Confluence: Active check and remote banner check.
- Atlassian Bitbucket: Active check and remote banner check.
- Atlassian Bamboo: Remote banner check.
- Atlassian Crowd: Remote banner check.
- Atlassian Fisheye and Crucible: Remote banner check.
