{"id":3417,"date":"2026-10-07T14:57:16","date_gmt":"2026-10-07T14:57:16","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3417"},"modified":"2026-10-07T14:57:16","modified_gmt":"2026-10-07T14:57:16","slug":"atlassian-data-center-flaw-draws-exploitation-attempts-within-two-hours-of-public-details","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3417","title":{"rendered":"Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Oct 07, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEityRbZfy1N9Y0SuqWl7yeWTYMjeirrTbDx719fM65Be6yXOt2Zl0YweAi0hAfswNzV_LrHa4eFCpcCemC3FNwxZve4bPkSelQiRnCdXpZofAnI7Si96nULBV6i25jgFaZkEY1T3LuPRhj6QzTSsWHZtLuoH1zXlLKZN3WwSiKS7QoY_Zug0CtaaCGozT6N\/s1700-nu-rw-lo-l85-e365\/jira-attack.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Threat actors have <a href=\"https:\/\/previdian.com\/CVE-2026-21589#telemetry\" target=\"_blank\">begun to exploit<\/a> a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions.<\/p>\n<p>The arbitrary file access flaw, tracked as <strong>CVE-2026-21589<\/strong> (CVSS score: 9.3) affects multiple products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye.<\/p>\n<p>\u00abThis arbitrary file access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions,\u00bb the Australian company said.<\/p>\n<p>\u00abExploitation requires prior knowledge of the target file&#8217;s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be sensitive files present that increase your risk.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/growth-ai-control-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVYuoalvwUlwvLZFDideJ8jW4rz-IodX0Lwi7uyP7Ab0wiDeu_BqVhPDdejQQ65MC3p9Xc4MApnHz56NJ5SDc1HMg0DvozkkGYv9TGtDLCh26v1yD5-GyzQxnA5-6A6B4beW96H_6FyrByq22cvU5JDF-i8e5GIfV4wg1SpCvjwAJt74FaqkAb2gzqE7ll\/s728-nu-rw-lo-l85-e365\/core-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Atlassian said impacted Atlassian Cloud products have been patched, adding that fixes are available for the following products &#8211;<\/p>\n<p><a name=\"more\"\/><\/p>\n<ul>\n<li>Bitbucket Data Center &#8211; 9.4.26, 10.2.8, and 10.5.1<\/li>\n<li>Confluence Data Center &#8211; 9.2.26 and 10.2.19<\/li>\n<li>Jira Service Management Data Center &#8211; 5.12.40, 10.3.26, and 11.3.12<\/li>\n<li>Jira Software Data Center &#8211; 9.12.40, 10.3.26, and 11.3.12<\/li>\n<li>Bamboo Data Center &#8211; 10.2.24 and 12.1.12<\/li>\n<li>Crowd Data Center &#8211; 6.3.7, 7.0.3, 7.1.7, and 7.2.4<\/li>\n<li>Crucible &#8211; 4.9.15<\/li>\n<li>Fisheye &#8211; 4.9.15<\/li>\n<\/ul>\n<p>As temporary mitigation, Atlassian is recommending that customers remove their instance from the public internet, apply a Web Application Firewall (WAF) rule, block requests using Tomcat&#8217;s RewriteValve (for Confluence, JSM, Jira, Bamboo, and Crowd), and add a new rule to urlrewrite.xml (for Bitbucket).<\/p>\n<p>According to telemetry data from Previdian, a total of 15 exploitation attempts have been detected from three unique IP addresses located in Japan and the U.S. &#8211;<\/p>\n<ul>\n<li>38.60.157[.]86<\/li>\n<li>146.70.187[.]234<\/li>\n<li>159.26.119[.]225<\/li>\n<\/ul>\n<p>The exploitation activity targeting its honeypot network is said to have begun two hours after watchTowr released <a href=\"https:\/\/labs.watchtowr.com\/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589\/\" target=\"_blank\">additional technical details<\/a> of the <a href=\"https:\/\/github.com\/watchtowrlabs\/watchTowr-vs-Atlassian-CVE-2026-21589\" target=\"_blank\">vulnerability<\/a>, stating it allows unauthenticated attackers to retrieve sensitive files within the webroot directory through a single request and extract tokens, credentials, keys, or other authentication material.<\/p>\n<p>According to the preemptive exposure management firm, the underlying vulnerability has to do with Atlassian&#8217;s web-resource handling, which converts a string like \u00ab..::..::..::..::WEB-INF::web.xml\u00bb to \u00ab..\/..\/..\/..\/WEB-INF\/web.xml.\u00bb <\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>As a result, an unauthenticated attacker with knowledge of the resource-resolution logic can abuse this path resolution logic and combine it with an Atlassian \u00ab\/includes\/jquery\/plugins\/colorpicker\/images\/\u00bb plugin resource by taking advantage of the trailing \u00abhttps:\/\/thehackernews.com\/\u00bb to reach other files (e.g., \u00abWEB-INF\/web.xml\u00bb) elsewhere in the application &#8211;<\/p>\n<pre><code>GET \/download\/resources\/jira.webresources:color-picker-popup\/images\/..::..::..::..::..::WEB-INF::web.xml HTTP\/1.1\n\nHost: {{Jira-Hostname}}<\/code><\/pre>\n<p>Importantly, in the case of Atlassian Crowd and Jira, the attacker could exploit the flaw to access \u00abWEB-INF\/classes\/crowd.properties,\u00bb which stores Crowd credentials, and then use them to gain administrative access to the application. Armed with this privileged access, it&#8217;s possible to create new users, modify user privileges, and elevate a newly created rogue user to Jira Administrator.<\/p>\n<p>\u00abWithin two hours of public exploit details becoming available, we were already seeing exploitation attempts hit our honeypot network,\u00bb Previdian Founder and CEO Ryan Dewhurst said in a statement shared with The Hacker News.<\/p>\n<p>\u00abThe release of a Nuclei template will make mass automated scanning even easier, so we expect activity around CVE-2026-21589 to increase quickly. Organizations running affected Atlassian products should treat patching as an immediate priority.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Oct 07, 2026Vulnerability \/ Web Security Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3418,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[2956,1202,308,38,1065,1594,65,70,582,328],"class_list":["post-3417","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-atlassian","tag-attempts","tag-center","tag-data","tag-details","tag-draws","tag-exploitation","tag-flaw","tag-hours","tag-public"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3417","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3417"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3417\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3418"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3417"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3417"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}