We covered this bug on Oct 7, when the only exploitation signal was a honeypot operator. That has changed. Previdian says its sensors first saw attempts on Oct 6 and were still seeing them on Oct 15. VulnCheck listed the bug as exploited on Oct 7, tied to activity against Bamboo Data Center (per Infosecurity Magazine). Shadowserver followed on Oct 14 (per Previdian), and now CISA. Confirmed victims: Undisclosed. Ransomware use: Unknown, per CISA.
What's affected. Every version of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye. Atlassian Cloud was patched before disclosure and Atlassian says it found no evidence of exploitation there. The flaw lives in a shared web-resource library that turns :: into /, so one unauthenticated request can read a file inside the web app root. It can't list directories, so the attacker needs the exact path. On Atlassian, the useful paths are well known.
Why it's worse than "just a file read". watchTowr showed that Jira deployments wired to Crowd for SSO keep crowd.properties with the Crowd application name and password in plain text. With that, an attacker who can reach Crowd's API can create a user and add it to jira-administrators. Crowd is Atlassian's recommended SSO path, which is why the at-risk population is large.
Fixed builds (per Atlassian): Jira Software 9.12.40, 10.3.26 or 11.3.12. JSM 5.12.40, 10.3.26 or 11.3.12. Confluence 9.2.26 or 10.2.19. Bitbucket 9.4.26, 10.2.8 or 10.5.1. Bamboo 10.2.24 or 12.1.12. Crowd 6.3.7, 7.0.3, 7.1.7 or 7.2.4. Crucible and Fisheye 4.9.15. If you can't upgrade this week, Atlassian's advisory lists interim rules: a WAF rule blocking the traversal patterns, Tomcat RewriteValve rules for most products, and a URL rewrite for Bitbucket.
What we'd do today. Find every self-hosted Atlassian instance, including the forgotten Fisheye box and the Bamboo server the build team owns. Patch, then treat any instance that was reachable since Oct 6 as possibly read. Search access logs for /download/resources/ requests containing ..:: or WEB-INF, and check for the three IPs Previdian published: 38.60.157[.]86, 146.70.187[.]234 and 159.26.119[.]225. If Jira talks to Crowd, rotate the Crowd application password, review jira-administrators and other admin groups for accounts nobody recognizes, and allowlist which IPs may use that Crowd application.