Overview
- Atlassian disclosed CVE-2026-21589 on October 5 and published patches for eight self‑hosted Data Center products while saying its cloud services were already patched.
- Researchers at watchTowr found the root cause in a shared web‑resource library that converts double colons (::) into path separators, allowing unauthenticated file reads from the web application root.
- Security teams and honeypots began seeing exploitation attempts within hours of watchTowr’s October 6 technical write‑up and public PoC, and automated Nuclei templates made mass scanning much easier.
- In deployments that use Crowd for single‑sign on, attackers who read WEB-INF/classes/crowd.properties can obtain plaintext credentials and use Crowd’s API to create admin accounts, enabling full takeover of Jira and linked apps.
- Atlassian urges immediate upgrade to the fixed releases or removal of internet access, and offers temporary mitigations such as WAF or Tomcat RewriteValve rules while operators search logs for the traversal indicators described in the advisory.