Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)

Just a day after Atlassian shipped fixes for a critical arbitrary file access bug (CVE-2026-21589) in its self-managed Data Center products, and hours after watchTowr researchers published technical analysis, threat intelligence firm Previdian reported seeing real exploitation attempts hitting its honeypots, along with a list of attacker IP addresses. The flaw impacts every version of Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye, and stems from a routing defect in the shared library atlassian-plugins-webresource*.jar, where a double-colon sequence bypasses slash-stripping protections and enables path traversal to read arbitrary files. watchTowr demonstrated that this can expose Crowd's plaintext credentials file, letting attackers authenticate to Crowd's SSO system, create accounts, and escalate to Jira administrator privileges. Atlassian is urging immediate patching, or isolating vulnerable instances from the internet and reviewing access logs for signs of compromise in the meantime.