Attacks on Atlassian Data Center flaw CVE-2026-21589 began within hours of security research firm WatchTowr Labs publishing its analysis on 6 October1. Data Center is the edition of Atlassian's collaboration software that organisations run on their own servers. CISA, which sets patch deadlines for US federal agencies, listed the flaw as exploited on 15 October. Exploitation running ahead of the federal listing has happened before: CrowdSec saw FortiSandbox attacks a month before CISA catalogued that flaw in July.
22OCT
Atlassian bug hit hours after a write-up
1 min read
16:31UTC
Attacks on Atlassian Data Center flaw CVE-2026-21589 began within hours of watchTowr Labs publishing its analysis on 6 October. CISA listed the flaw as exploited on 15 October.
TechnologyAssessed
Deep Analysis
In plain English
Atlassian makes Jira and Confluence, tools companies use to track work and share documents. Some companies run their own copies, called Data Center editions. A flaw let outsiders read files from those servers without logging in, and attackers began using it within hours of researchers explaining how it worked.
Root Causes
Data Center editions run on customers' own servers, often heavily customised, so upgrades can lag behind Atlassian's fixes. A web-resource library shared across the Data Center range spread one bug to several products at once.
What could happen next?
- Risk
Self-hosted Atlassian servers left unpatched since early October may already have exposed stored credentials.
First Reported In
Update #15 · Fridge hack spoils food in seven countries
CISA· 22 Oct 2026
Read original →Different Perspectives
Hospital Sírio-Libanês
Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.
The Foschini Group
The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.
FirstVDS
FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.
ESET
ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.
JPCERT/CC
JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.
Cyber Security Agency of Singapore
The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.