Atlassian Data Center flaw exploited in wild
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
An unauthenticated arbitrary file access vulnerability in multiple Atlassian Data Center products is being actively exploited, CISA/MS-ISAC warns.
MS-ISAC has issued an advisory for CVE-2026-21589, an arbitrary file access vulnerability affecting multiple self-managed Atlassian Data Center products including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. The flaw allows an unauthenticated attacker to retrieve specific files within the web application root directory, provided they already know the exact file name and path; it does not allow directory listing or enumeration. Depending on configuration, sensitive files may be exposed, increasing organizational risk.
The advisory states there are reports of this vulnerability being exploited in the wild, making patching a priority for any organization running affected on-premises Atlassian Data Center editions. Affected version ranges span current and recent releases of each product line. Recommended mitigations include applying vendor patches immediately after testing, maintaining a vulnerability and patch management process, restricting administrative access, applying least privilege, and using network segmentation/DMZ isolation for internet-facing instances to reduce exposure.
Mentioned in this report
Detection guidance
Web Request Retrieving Sensitive Application Files from Web Root with Success
Successful HTTP request for protected application-internal or configuration files (WEB-INF, META-INF, Atlassian config files) served from a web root, consistent with unauthenticated arbitrary file access exploitation of self-managed Atlassian Data Center products. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Request Retrieving Sensitive Application Files from Web Root with Success
description: Detects successful HTTP requests for files that should never be served
directly (WEB-INF, META-INF, Atlassian home/config files such as confluence.cfg.xml,
dbconfig.xml). Matches an unauthenticated arbitrary file access pattern against
Java web apps like Atlassian Data Center products, where the attacker already knows
the exact file path.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains:
- /WEB-INF/
- /META-INF/
- confluence.cfg.xml
- dbconfig.xml
- bitbucket.properties
- jira-config.properties
- crowd.cfg.xml
- seraph-config.xml
selection_status:
sc-status: 200
condition: selection_path and selection_status
falsepositives:
- Vulnerability scanners run by the security team against internal Atlassian instances
- Misconfigured reverse proxies that intentionally expose static resources under a
META-INF path
level: high
id: 5723ab1f-26b9-5d7e-8be4-27387cd1aa5f
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-atlassian-data-center-products-could-allow-for-arbitrary-file-access_2026-112
Successful Web Request with Path Traversal Sequences in URI
Successful HTTP response to a request whose URI contains plain or encoded directory traversal sequences, a common way to reach arbitrary files in a web application root on public-facing servers such as Atlassian Data Center. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Successful Web Request with Path Traversal Sequences in URI
description: Detects HTTP requests containing plain, URL-encoded or double-encoded
traversal sequences in the URI path that returned HTTP 200. Useful for spotting
file-access exploitation attempts against internet-facing web applications such
as Atlassian Data Center products. Tune by restricting to Atlassian hosts or context
paths.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_traversal:
cs-uri-stem|contains:
- ../
- ..\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- '%2e%2e%5c'
- '%252e%252e'
- ..;/
selection_status:
sc-status: 200
condition: selection_traversal and selection_status
falsepositives:
- Legacy web applications or integrations that normalise relative paths in URLs
- Authorised penetration tests and vulnerability scans
level: medium
id: e2f4524d-a939-5d7e-bb21-e6ee99086664
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-atlassian-data-center-products-could-allow-for-arbitrary-file-access_2026-112
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-atlassian-data-center-products-could-allow-for-arbitrary-file-access_2026-112
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs