If you host Atlassian yourself, assume the boxes are reachable until you prove otherwise. On October 5 Atlassian disclosed a critical flaw that lets an attacker with no login read specific files from the web application root on eight Data Center products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. Cloud is already patched. Your self-hosted instances are not, and Atlassian is telling customers to take internet-facing ones offline until they upgrade or put a blocking rule in place.
No login required. Eight products. If the attacker already knows the path, the file comes back.
CVE-2026-21589 returns any file the attacker can name
CVE-2026-21589 is an unauthenticated arbitrary file access / path traversal bug. Atlassian scored it 9.3 under CVSS 4.0. An attacker who already knows a file’s exact name and path can pull it from the web application root. The bug does not let them list directories, which limits the damage. It does not make it safe. In some configurations the root holds sensitive files, and Atlassian’s own score rates the confidentiality impact as high.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The advisory landed October 5, 2026. Atlassian says its affected cloud products are already patched and that its investigation has not found evidence of exploitation against cloud. It cannot say the same for your Data Center nodes. A similar path-traversal pattern in Jira (CVE-2021-26086) later made CISA’s Known Exploited Vulnerabilities catalog, so don’t hold off because there is no evidence yet.
Source, wiki, tickets and builds behind one exposed node
Bitbucket, Confluence, Jira, Bamboo and Crowd hold your source code, wiki, tickets, build pipeline and identity directory. One internet-facing Confluence or Bitbucket node is enough. Operators who only patched the late-September NetScaler builds still have this on the desk, and Wednesday’s NetScaler KEV due date does not cover it.
Upgrade, or pull public nodes and add the blocking rule
- Inventory every self-hosted Atlassian Data Center (and lingering Server) instance. Include mirrors and mirror-farm nodes for Bitbucket.
- Upgrade immediately to a fixed build for each product (see Details). Prefer a fixed LTS line if you are behind.
- Until you can patch: take public instances off the internet, or apply Atlassian’s temporary WAF / reverse-proxy rule that blocks URLs with
..next to/,\or::(including URL-encoded forms). Confluence, Jira, Bamboo and Crowd can also use a Tomcat RewriteValve rule; Bitbucket has aurlrewrite.xmlrule. Restart after installing either. - Have security review access logs: URL-decode each request line up to twice and look for
..adjacent to path separators, or run Atlassian’s block pattern over the raw lines. - Cloud-only tenants: no action. Bitbucket Cloud is not affected.
Forward this
If you own Confluence, Jira, Bitbucket, Bamboo or Crowd on our own servers: Atlassian disclosed a critical unauthenticated file-read bug on October 5 that hits all eight Data Center products. Cloud is fixed. Ours are not. Please schedule the fixed builds this week, and until then keep any internet-facing instance off the public network or behind the temporary WAF rule Atlassian published. Security should also check access logs for path-traversal probes.
Details
- CVE: CVE-2026-21589 — unauthenticated arbitrary file access / path traversal. Atlassian CVSS 4.0 score 9.3 (Critical).
- Products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd Data Center; Crucible; Fisheye. All versions before the fixed builds below. End-of-life versions may also be affected.
- Fixed builds (as of Oct 6): Bitbucket DC 9.4.26 / 10.2.8 / 10.5.1; Confluence DC 9.2.26 / 10.2.19; Jira Software DC 9.12.40 / 10.3.26 / 11.3.12; Jira Service Management DC 5.12.40 / 10.3.26 / 11.3.12; Bamboo DC 10.2.24 / 12.1.12; Crowd DC 6.3.7 / 7.0.3 / 7.1.7 / 7.2.4; Crucible and Fisheye 4.9.15.
- Cloud: Patched. No customer action. Bitbucket Cloud not affected.
- Exploitation: Atlassian reports no evidence on cloud. Advisory does not confirm or deny attacks on self-hosted instances. Prior similar Jira path traversal (CVE-2021-26086) is in CISA KEV.
- Disclosed: October 5, 2026. Product tickets include CONFSERVER-104488, BSERV-20604 and siblings.
Hunt / verify
- Confirm each node’s version against the fixed-build table above (Admin → System info, or the product’s about page).
- Search access logs for requests containing
..next to/,\or::, including%2e%2e,%2f,%5cand double-encoded forms. URL-decode up to twice before matching. - Flag any hit that returned 200 with a body size matching a known sensitive file (configuration, keystore, properties under the webapp root).
- After upgrade, keep the WAF rule in place for a week while you watch for residual probes.
Self-hosted Atlassian: patch CVE-2026-21589 (unauth file read, CVSS 9.3) on Bitbucket/Confluence/Jira/Bamboo/Crowd/Crucible/Fisheye to the Oct 5 fixed builds. Until then, pull internet-facing instances offline or apply Atlassian’s WAF/RewriteValve rule blocking .. next to path separators. Cloud already fixed. Check access logs for traversal probes.
Sources
- https://jira.atlassian.com/browse/CONFSERVER-104488
- https://jira.atlassian.com/browse/BSERV-20604
- https://www.helpnetsecurity.com/2026/10/06/atlassian-data-center-cve-2026-21589/
- https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html
- https://www.cve.org/CVERecord?id=CVE-2026-21589
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
