Hackers exploit critical Atlassian flaw after public PoC release
2026-10-07T13:23:30Z•1d0f7976d33fdafa88033e64ff52ce706ab9f2cf71c58f3b001a101f21ed1aaa
CVE-2026-21589CVE-2026-61500AtlassianBitbucketConfluenceJiraMFA theftRejetto HFSSSRFSonicWall SMA1000WordPressaccount takeoveractive exploitationcredential theftdata breachphishingransomwareremote code executionstored XSSvulnerability
What happened
BleepingComputer reports active exploitation and scanning of multiple critical vulnerabilities, including unauthenticated arbitrary file access in self-hosted Atlassian Jira, Confluence, and Bitbucket products (CVE-2026-21589), a maximum-severity SonicWall SMA1000 SSRF flaw, and Rejetto HFS session forgery, account takeover, and RCE (CVE-2026-61500). Additional coverage includes exploited WordPress plugin XSS flaws, ransomware-related data theft, phishing campaigns stealing credentials and MFA codes, and confirmed breaches affecting ASOS and Nikkei.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 1d0f7976d33fdafa88033e64ff52ce706ab9f2cf71c58f3b001a101f21ed1aaa
- Enrichment time
- 2026-10-07T13:23:30Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.