Affected Systems
Self-hosted Atlassian Data Center products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Unauthenticated arbitrary file read vulnerability. Crowd-integrated deployments at highest risk for admin account creation.
Exploitation Status
Active exploitation confirmed. Previdian detected attacks within 2 hours of watchTowr publishing technical PoC on October 7, 2026. Nuclei scanning template now available. Exploitation attempts observed from IPs 38.60.157.86, 146.70.187.234, and 159.26.119.225.
Business Impact
Unauthenticated attackers can read arbitrary files from application web root if exact path is known. In Crowd-integrated deployments, attackers can extract plaintext credentials from crowd.properties and create Jira administrator accounts via Crowd API, leading to full environment compromise. Automated scanning tools accelerate attacker reconnaissance. Cloud-hosted instances not affected.
Urgency
🔴 Immediate
Recommended Actions
- Apply Atlassian security updates immediately for all affected Data Center products per vendor bulletin
- Block observed attacker IPs: 38.60.157.86, 146.70.187.234, 159.26.119.225 at perimeter firewall
- Deploy WAF or proxy rules blocking directory traversal patterns containing double colons (::) across all Atlassian product endpoints
- Run watchTowr's free scanner tool to identify vulnerable instances in your environment
- If patching is delayed, restrict external network access to Atlassian instances and implement Tomcat RewriteValve rules or URL rewrite rules per Atlassian advisory