Atlassian file-access flaw draws exploitation attempts as fixes become available

Previdian detected 15 exploitation attempts against its honeypots from three IP addresses after technical details emerged for CVE-2026-21589, a critical file-access flaw affecting multiple Atlassian Data Center products. Attempts began within two hours of watchTowr publishing additional details. The flaw lets unauthenticated attackers retrieve specific files inside an application's web root by abusing resource-path handling. In Crowd and Jira, exposed Crowd credentials could enable administrative access. Atlassian says fixes are available for affected products and impacted Cloud products have been patched. Attackers must know a target file's exact name and path; the flaw cannot list directory contents.