Exploitation attempts against the critical vulnerability CVE-2026-21589 in Atlassian Data Center products began within hours of a public proof-of-concept release. The flaw permits unauthenticated reading of specific files and, in environments integrated with Crowd, can lead to privilege escalation up to administrator rights.
The defect affects a wide range of Atlassian Data Center deployments, including Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. It received a CVSS v4.0 score of 9.3 from Atlassian. The availability of a Nuclei template has lowered the barrier for large-scale automated scanning.
The vulnerability does not allow directory enumeration. Attackers must already know the exact file name and path. It exploits how a shared web resource library converts double-colon sequences into path separators, enabling path traversal requests against plugin resource endpoints.
The most severe scenario occurs when Jira is integrated with Crowd. Reading WEB-INF/classes/crowd.properties can expose plaintext credentials in certain configurations, allowing an attacker to create accounts and gain administrator privileges through the Crowd API.
Atlassian recommends applying fixed versions immediately, removing affected instances from the internet, or restricting external access. Additional mitigations include deploying WAF rules or enabling Tomcat RewriteValve with rewrite rules to block traversal patterns in Confluence, Jira, Jira Service Management, Bamboo, and Crowd. For Bitbucket Data Center the equivalent configuration is applied in urlrewrite.xml.
Administrators hunting for prior activity should examine access logs after double URL decoding and search for sequences containing .. combined with /, \, or ::, or apply the vendor-supplied search expression. If logs show access to sensitive configuration files, organizations must rotate credentials, strengthen network controls, and consider IP allow-listing in Crowd.
