CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Rapid7 reports that on October 5, 2026, Atlassian published a security advisory for CVE-2026-21589[2]. The flaw affects Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye.[2] According to Rapid7, Atlassian assigned the vulnerability a CVSSv4 score of 9.3.[2]Atlassian's advisory says the flaw "allows an unauthenticated attacker to access specific files within the web application root directory"[3].Help Net Security reports that watchTowr researchers traced it to atlassian-plugins-webresource*.jar, a library shared by the vulnerable solutions[4]. Rapid7 says that in watchTowr's tests on a Crowd deployment with Jira configured, reading WEB-INF/classes/crowd.properties exposed application credentials.[2]Help Net Security reports that the threat intelligence firm Previdian warned that "exploitation attempts have now started to hit our honeypot network"[4]. Jake Knott of watchTowr told The Hacker News that "no post-compromise activity or attackers attempting to utilize the credentials obtained by exploiting the vulnerability have been observed so far."[1]The Cyber Express reports that Atlassian says its Cloud products have already been patched, its investigation found no sign of exploitation there[5].According to Help Net Security, Atlassian urged customers to upgrade to a fixed version as soon as possible.[4] Rapid7 says it recommends patching on an emergency basis, outside of normal patch cycles[2].