Scans for Atlassian vulnerablity (CVE-2026-21589) - SANS ISC
Reported exploitedBitbucket Data CenterConfluence Data CenterOur summary
Atlassian issued patches on October 5th for an arbitrary file access flaw tracked as CVE-2026-21589, affecting several of its products including Jira, Confluence and Bitbucket. The bug stems from how these applications sanitize path traversal attempts by substituting slashes with a "::" sequence, which under certain conditions can be reversed by attackers to escape the intended resource directory and read files such as web.xml inside WEB-INF, exposing configuration data.
A detailed technical breakdown and working proof-of-concept requests were published by Watchtowr shortly after the patch release. SANS ISC reports that since October 6th its honeypots have recorded exploitation attempts using URL patterns matching those PoCs, targeting Jira, Bitbucket and Confluence webresource endpoints. The requests all appear to originate from a single actor operating through a cluster of Digital Ocean-hosted IP addresses, suggesting automated mass scanning is already underway against unpatched instances.
Below is the opening; the full story is at SANS Internet Storm Center.
From SANS Internet Storm Center
On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's directory, potentially exposing sensitive information such as configuration files.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.