Atlassian Data Center CVE-2026-21589 Is Under Attack: Patch, Hunt Your Logs, Rotate Secrets

Public technical analysis appeared on October 6. Within about two hours, threat-intelligence firm Previdian’s honeypots began recording exploitation attempts, and BleepingComputer and Help Net Security reported the activity on October 7. Previdian has since logged more than a hundred attempts from 21 source IP addresses in eight countries, and a public scanning template now makes mass checks easy. Atlassian has said it cannot tell whether individual customer instances have been compromised.

“Exploitation attempts have now started to hit our honeypot network”

— Previdian (@PrevidianCyber) on X, October 6, 2026

That October 6 technical analysis came from watchTowr, and the full write-up is on watchTowr Labs.

No confirmed victim breach has been made public yet. That is not a reason to wait: the gap between attempts on honeypots and real intrusions is usually short for internet-facing Atlassian servers.

What is affected

All versions before the fixed releases are affected, including unsupported versions. Atlassian Cloud is already patched and needs no action.

Why a “file read” is rated critical

Reading files sounds limited. On these products it often isn’t. Researchers showed that where Jira is connected to Atlassian Crowd (the identity and single sign-on hub), the readable files can include Crowd application credentials stored in plain text. With network access to Crowd, those credentials can be used to change users and group membership, which can amount to administrator access to Jira and other connected apps. Other files in the web root can hold database connection details. Restricting which IP addresses may talk to Crowd makes that escalation much harder, but it does not fix the flaw.

What to do, in order

1. Inventory. List every self-hosted Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye instance, including test, staging and forgotten ones. Note which are reachable from the internet.
2. Patch. Upgrade each instance to a fixed version from the table, or the latest release. Treat this as an emergency change, not a normal patch-cycle item.
3. If you cannot patch today, cut exposure. Take affected instances off the internet or restrict them to VPN or trusted networks. Atlassian also publishes interim WAF or proxy rules for all products, a Tomcat rewrite rule for Confluence, Jira, JSM, Bamboo and Crowd, and a separate rewrite rule for Bitbucket. These reduce risk but do not replace upgrading.

4. Hunt in access logs, even after patching. Atlassian recommends URL-decoding each request line up to twice, then searching for .. immediately next to /, \ or ::. Atlassian also provides this regular expression for raw logs:

   (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*

   Pay closest attention to matches that returned a successful response, and to requests referencing configuration files such as database configs, server.xml, or crowd.properties.

5. Block known sources. Previdian reported attempts from 38.60.157[.]86, 146.70.187[.]234 and 159.26.119[.]225. Blocking them is cheap, but expect new addresses.
6. Rotate if you find successful reads. If logs show a protected config file was served, contain the host, then rotate the database passwords, Crowd application credentials, API tokens and other secrets those files held. Review Crowd and Jira for new users or unexpected admin group membership created since October 5.
7. Lock down Crowd. Make sure Crowd only accepts application connections from the specific servers that need it.

How a penetration test helps

Exposed Atlassian servers are a recurring finding in external infrastructure tests, often because an old staging instance was never decommissioned. An external attack-surface review confirms which instances are actually reachable, and an internal assessment checks whether a stolen application credential could move from Jira or Confluence into your identity systems. PoCForge does not publish or use exploit code for this issue outside authorised engagements.

Sources

• Rapid7 ETR (Oct 7, 2026): CVE-2026-21589, critical unauthenticated arbitrary file access in Atlassian products
• watchTowr Labs (Oct 6, 2026): Atlassian Jira, Confluence (and more) pre-auth arbitrary file read, CVE-2026-21589
• BleepingComputer (Oct 7, 2026): Hackers exploit critical Atlassian flaw after public PoC release
• Help Net Security (Oct 7, 2026): Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)
• Previdian: CVE-2026-21589 exploitation record
• CERT-EU Security Advisory 2026-015: Critical Vulnerability in Multiple Atlassian Products
• CVE record: CVE-2026-21589