CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

According to Atlassian's advisory, all versions of Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye are affected[2]. Atlassian says the flaw "allows an unauthenticated attacker to access specific files within the web application root directory"[2].Rapid7 reports that Atlassian assigned the vulnerability a CVSSv4 score of 9.3[3]. Rapid7 also says affected Atlassian Cloud products have already been patched, and no action is required from Cloud customers[3].Help Net Security reports that watchTowr found a quirk in the routing code: functions that convert double colons (::) into forward slashes (/)[4]. According to Rapid7, in watchTowr's tests on a Crowd deployment with Jira configured, reading WEB-INF/classes/crowd.properties exposed application credentials[3].Help Net Security reports that attackers have been spotted attempting to exploit it[4] one day after Atlassian released patches. Jake Knott, watchTowr's head of threat intelligence, told The Hacker News that "No post-compromise activity or attackers attempting to utilize the credentials obtained by exploiting the vulnerability have been observed so far."[5]Rapid7 says detailed technical analysis and file-read proof-of-concept scripts are public[3], and it recommends patching on an emergency basis.According to The Cyber Express, Atlassian says teams that cannot upgrade yet should take instances offline from the internet where possible, including those protected by user authentication[6].