Hackers exploit critical Atlassian flaw after public PoC release

Threat actors have begun exploiting CVE-2026-21589, a critical unauthenticated file-access bug affecting self-hosted Atlassian products such as Jira, Confluence, and Bitbucket, among eight impacted Data Center/server tools. Security firm Previdian says its honeypots picked up active scanning and exploitation attempts within just two hours of researchers at watchTowr publishing a detailed writeup and public proof-of-concept exploit. The flaw stems from a shared web-resource component that mishandles double-colon sequences, letting attackers craft directory-traversal requests through plugin endpoints to read restricted files without logging in. In Crowd-integrated setups, this can expose plaintext credentials that let attackers escalate to full Jira administrator access via Crowd's API. A Nuclei template is now circulating too, making mass scanning trivial, so researchers expect attack volume to keep climbing. Atlassian customers running affected self-hosted instances should install the vendor's patches immediately or apply the listed network and web-server mitigations without delay.