Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

Attackers started probing a critical unauthenticated file-access flaw in Atlassian's Data Center software just two hours after researchers at watchTowr published technical exploitation details. The bug, CVE-2026-21589 (CVSS 9.3), lets an unauthenticated actor fetch specific files from the web application root of Bitbucket Data Center, Confluence Data Center, Jira Software and Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye, provided they already know the exact file path. Security firm Previdian logged 15 exploitation attempts from three IPs in Japan and the US hitting its honeypots, and warned that in Crowd and Jira deployments the technique can expose crowd.properties credentials, enabling attackers to create rogue accounts with full Jira Administrator rights. Atlassian has shipped patched builds for each affected product and urges customers to upgrade immediately or apply interim mitigations such as WAF rules, Tomcat RewriteValve blocks, or urlrewrite.xml changes while a public Nuclei template is expected to accelerate mass scanning.