CISA Confirms Exploitation of Jira and Confluence Flaw

CISA, the U.S. government cybersecurity agency, added the CVE-2026-21589 vulnerability to its actively exploited vulnerabilities catalog on Thursday, October 15. The flaw affects the Data Center versions of Atlassian products, including Jira, Confluence, and Bitbucket, allowing an unauthenticated attacker to read server files. According to the agency's notice, the inclusion was based on evidence of active exploitation.

Atlassian disclosed the vulnerability on October 5, assigning it a score of 9.3 on the CVSS 4.0 scale. The flaw impacts eight self-managed products: Jira, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Atlassian Cloud is not affected.

From File Reading to Admin Control

Reading files may seem less severe than executing code, which is why this case deserves attention. watchTowr, an offensive research company that published a functional proof of concept, demonstrated the method. Jira installations integrated with Crowd, Atlassian's identity directory, store the application name, plaintext password, and Crowd server address in the crowd.properties file. With this information, the researchers created a new user in Crowd, placed them in the Jira admin group, and gained administrative control of the instance.

Previdian, which operates honeypot sensors, reported observing exploitation attempts as early as October 6, just a day after Atlassian's notice. Following this, the usual sequence unfolded: public code, automated scanning templates, and widespread hostile traffic. CISA's entry in the catalog formalizes what these sensors had already indicated, compelling U.S. federal civil agencies to patch their systems within the timeline set by the agency.

The Patched Versions

The tables published following Atlassian's notice indicate secure versions, including: Jira Software 9.12.40, 10.3.26, and 11.3.12; Jira Service Management 5.12.40, 10.3.26, and 11.3.12; Confluence 9.2.26 and 10.2.19; Bitbucket 9.4.26, 10.2.8, and 10.5.1; Crowd 6.3.7, 7.0.3, 7.1.7, and 7.2.4. For Bamboo, Crucible, and Fisheye, the reference is the manufacturer's bulletin itself.

The actual exposure depends on the architecture. According to watchTowr, if Crowd accepts connections only from an authorized IP list, the escalation scenario becomes significantly more challenging, even with file reading. Instances that expose Jira to the internet without any front-end filtering are the obvious targets for scans.

Atlassian provides temporary mitigations but describes these measures as limited and not substitutes for an update. For those using Crowd, researchers recommend a dual approach: changing the application passwords stored in crowd.properties and restricting Crowd access to an authorized IP address list. Fixing the issue without changing the password leaves the door open for anyone who read the file before the patch.

Where the Risk Lies

The exposed audience is precisely that which chose not to move to the cloud. Companies and governments that maintain Jira and Confluence on their own servers typically do so due to data sovereignty demands or sector regulation, and it is these environments that carry the history of projects, integration credentials, and internal technical documentation.

In the U.S., the pressure comes from the federal deadline and government contractors, who often inherit CISA's requirements in their contracts. In Australia, home to Atlassian, public agencies and critical infrastructure operators respond to the Australian Cyber Security Centre, and the proximity to the manufacturer does not reduce exposure: the Data Center versions are the same in Sydney and Washington. In Germany and the rest of the EU, the NIS2 directive mandates essential operators to manage known vulnerabilities, and a flaw listed as exploited by CISA serves as proof that the risk was recognized.

In Brazil, the most direct channel involves consultancies and software factories that maintain Data Center instances to host client projects. In these environments, a single Jira consolidates repositories and credentials from various contractors, and a successful breach crosses the boundary between provider and client. The same applies to delivery centers in India and Eastern Europe that operate development tools for banks and insurers from other countries.

For the CISO, the most useful data is the interval: ten days separate the manufacturer's notice from the formalization by the U.S. agency, and those who waited for the official stamp to prioritize the patch remained vulnerable to an attack with already public code throughout that period.