CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Rapid7 reports that Atlassian published an advisory on October 5, 2026 for the flaw, which affects eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye.[3] Rapid7 says Atlassian gave the vulnerability a CVSSv4 score of 9.3.[3]Atlassian's advisory says the flaw "allows an unauthenticated attacker to access specific files within the web application root directory"[4].Help Net Security reports that watchTowr traced the bug to functions in the routing code that convert double colons (::) into forward slashes (/).[5] According to Rapid7, in a test Crowd deployment with Jira configured, watchTowr found that reading WEB-INF/classes/crowd.properties exposed application credentials.[3]The Hacker News reports that watchTowr confirmed it is observing active, in-the-wild exploitation[6]. watchTowr's Jake Knott told the outlet that "No post-compromise activity or attackers attempting to utilize the credentials obtained by exploiting the vulnerability have been observed so far."[6]According to The Cyber Express, Atlassian says its Cloud products have already been patched, it found no sign of exploitation there, and Cloud customers need to take no action.[7]Help Net Security reports that Atlassian urged customers to upgrade to a fixed version as soon as possible, and advised those who cannot to remove vulnerable instances from the internet[5]. Rapid7 says that because proof-of-concept scripts are public, it recommends patching on an emergency basis, outside of normal patch cycles[3].