CVE-2026-21589: Atlassian Data Center products: unauthenticated arbitrary file access

Exploited in the wild Critical 9.3 EPSS 99.5% Atlassian Confluence

A path traversal flaw in Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, as well as Crucible and Fisheye, lets an unauthenticated attacker read specific files inside the web application root directory if they know the exact file name and path (directory listing is not possible). Atlassian says all versions before the fixed releases announced on October 5, 2026 are affected and rates it critical (CVSS 4.0 score 9.3); Atlassian Cloud is already patched. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-15 as exploited in the wild.

CVE-2026-21589CVE identifier
9.3CVSS 4.0 base score (critical)
2026-10-15added to CISA's exploited list (US federal deadline 2026-10-18)
99.5%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
2026-10-05published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run Atlassian Confluence and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
Upgrade (or apply a mitigation to) every node of a Data Center cluster and restart each node; for Bitbucket also cover all mirrors and mirror farm nodes. Installer-based (non-Docker) installs are upgraded with the installer for the fixed version from Atlassian's download archives.
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
Because this flaw is being exploited, also check the server for signs of compromise.

Affected and fixed versions

Affected:

Bitbucket Data Center: all versions before the fixed releases (introduced in 4.6.0)
Confluence Data Center: all versions before the fixed releases (introduced in 5.10.0)
Jira Software Data Center: all versions before the fixed releases (introduced in 7.1.0)
Jira Service Management Data Center: all versions before the fixed releases (introduced in 3.1.0)
Bamboo Data Center: all versions before the fixed releases (7.0.1 and later)
Crowd Data Center: all versions before the fixed releases (introduced in 2.11.0)
Crucible and Fisheye: all versions before 4.9.15

Fixed in:

Bitbucket Data Center 9.4.26, 10.2.8, 10.5.1
Confluence Data Center 9.2.26, 10.2.19
Jira Software Data Center 9.12.40, 10.3.26, 11.3.12
Jira Service Management Data Center 5.12.40, 10.3.26, 11.3.12
Bamboo Data Center 10.2.24, 12.1.12
Crowd Data Center 6.3.7, 7.0.3, 7.1.7, 7.2.4
Crucible 4.9.15
Fisheye 4.9.15

Am I affected?

docker inspect --format '{{.Config.Image}}' <container-name>

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian

vendor installer

Ubuntu

vendor installer

RHEL, AlmaLinux, Rocky, Oracle

vendor installer

Fedora

vendor installer

SUSE / openSUSE

vendor installer

Amazon Linux

vendor installer

Arch Linux

not supported

Alpine

not supported

FreeBSD

not supported

Docker images

# pull the fixed tag for your product line, then re-create the container with the same volumes and ports
docker pull atlassian/confluence:10.2.19             # or 9.2.26
docker pull atlassian/jira-software:11.3.12          # or 10.3.26 / 9.12.40
docker pull atlassian/jira-servicemanagement:11.3.12 # or 10.3.26 / 5.12.40
docker pull atlassian/bitbucket:10.5.1               # or 10.2.8 / 9.4.26
docker pull atlassian/bamboo:12.1.12                 # or 10.2.24
docker pull atlassian/crowd:7.2.4                    # or 7.1.7 / 7.0.3 / 6.3.7
# example for Confluence:
docker stop confluence && docker rm confluence
docker run -v /data/your-confluence-home:/var/atlassian/application-data/confluence --name="confluence" -d -p 8090:8090 -p 8091:8091 atlassian/confluence:10.2.19

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

If you cannot patch yet

Atlassian: if you cannot patch yet, remove the instance from the internet (including instances that require login) until you can patch or mitigate.
Option 1 (all products): in your WAF or reverse proxy, block any URL matching this regex, then test that it blocks '..' next to '/', '\' or '::' including URL-encoded forms: (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*
Option 2 (Confluence, Jira, Jira Service Management, Bamboo, Crowd), on each node with the node shut down: add <Valve className="org.apache.catalina.valves.rewrite.RewriteValve" /> inside the application's <Context> element in conf/server.xml (Crowd: apache-tomcat/conf/Catalina/localhost/crowd.xml or apache-tomcat/conf/server.xml), then create or append WEB-INF/rewrite.config (confluence/WEB-INF, atlassian-jira/WEB-INF, bamboo/WEB-INF or atlassian-bamboo/WEB-INF, crowd-webapp/WEB-INF) with: RewriteCond %{REQUEST_PATH} (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).* RewriteRule (?s)^.*$ /?denied [F,L] RewriteCond %{REQUEST_URI} (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).* RewriteRule (?s)^.*$ /?denied [F,L] Then restart the node.
Option 3 (Bitbucket only), on every node and mirror: add this rule at the top of <installation-directory>/app/WEB-INF/urlrewrite.xml, before the other rules, then restart Bitbucket: <rule> <from>(?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*</from> <set type="status">404</set> <to>/mvc/error404</to> </rule>

Look for signs of exploitation

Atlassian: URL-decode each access-log request line (up to two decoding passes) and look for '..' immediately next to '/', '\' or '::'; or search the raw (not decoded) log lines with the same regex as the WAF rule.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21589

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.