Atlassian Data Center File Read CVE-2026-21589 Exploited

What to do

1. List every self-managed Atlassian instance, including test, staging and Bitbucket mirrors.
2. Upgrade each to a fixed version for its line (or the latest release), on every cluster node.
3. If you cannot patch today, take internet-facing instances off the internet, or block URLs with '..' next to /, \ or :: (including URL-encoded forms) using Atlassian's WAF regex or Tomcat RewriteValve rule.
4. Search access logs (URL-decoded up to twice) for '..' adjacent to /, \ or :: since early October.
5. If any request matched, treat files in the web application root as exposed and rotate any secrets they contain.

How to check if you are affected or compromised

• Compare product versions (Administration > System information, or the footer) with the fixed versions.
• Grep access logs for traversal sequences, e.g. grep -Ei '(\.\.|%2e%2e)(/|%2f|\\|%5c|::)' access_log*, after URL-decoding twice.
• Run the public watchTowr detection script only against your own instances to confirm patch status.
• Look for successful (200) responses to requests containing traversal patterns from unfamiliar IP addresses.

What happened#

On October 5, 2026 Atlassian published an advisory for CVE-2026-21589, an arbitrary file access flaw in essentially its whole self-managed line. Affected products are Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye. An unauthenticated attacker can read specific files inside the web application root directory. Atlassian rates it Critical, CVSS 4.0 score 9.3.

There are limits. The attacker has to know the exact name and path of the target file, and the bug "does not allow attackers to enumerate or list directory contents." Atlassian warns, though, that "in some configurations, there may be sensitive files present that increase your risk." The mitigations it published all block .. sequences next to /, \ or ::, which means this is a path-traversal bug.

watchTowr published a detection script for Jira, Confluence and Bitbucket on October 6. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 15 and set a federal remediation due date of October 18.

Who is affected#

Atlassian says all versions before the fixed releases are affected. The CVE record gives starting points: Bitbucket from 4.6.0, Confluence from 5.10.0, Jira Software from 7.1.0, Jira Service Management from 3.1.0, Bamboo from 7.0.1 and Crowd from 2.11.0. In practice that is any self-managed instance not patched since early October. Atlassian Cloud was patched by Atlassian, which says it found no evidence of exploitation there and that no Cloud customer action is needed.

Do you really need to act?#

If you run any of these products yourself, yes. Several factors push this to the top of the list:

• No authentication is required, and the products are often exposed to the internet for remote staff, customers (Jira Service Management) or CI integrations (Bitbucket, Bamboo).
• Exploitation is confirmed by CISA. Its vulnrichment data in the CVE record marks exploitation as "active" with "total" technical impact.
• The "needs the exact path" limitation is weaker than it sounds for software that is installed the same way everywhere. Attackers know where standard files live.
• NVD records Atlassian's vector with high confidentiality impact and high subsequent-system impact. The bug reads files rather than writing them, but what it reads can unlock other systems.

Atlassian says "instances accessible to the public internet, including those with user authentication, should be restricted from external network access" until patched or mitigated. Instances reachable only on an internal network are less urgent, but still a short-fuse patch.

What to do now#

1. Inventory every Data Center, Crucible and Fisheye instance, including staging, DR, and Bitbucket mirrors and mirror farm nodes.
2. Upgrade to a fixed version. Atlassian recommends the fixed LTS or later. Fixed versions are Bitbucket 9.4.26, 10.2.8 or 10.5.1; Confluence 9.2.26 or 10.2.19; Jira Software 9.12.40, 10.3.26 or 11.3.12; Jira Service Management 5.12.40, 10.3.26 or 11.3.12; Bamboo 10.2.24 or 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7 or 7.2.4; Crucible and Fisheye 4.9.15. Patch every cluster node.
3. If you cannot patch now, take the instance off the internet. Or apply one of Atlassian's mitigations on every node: a WAF or proxy rule using its regex (block .. adjacent to /, \ or ::, including URL-encoded forms), Tomcat's RewriteValve with the provided rewrite.config (Confluence, Jira, JSM, Bamboo, Crowd), or a urlrewrite.xml rule (Bitbucket). Test that encoded variants are actually blocked.
4. Restart the nodes after configuration changes, and confirm the rule fires.

How to tell if you were hit#

Atlassian says it "cannot confirm if your instances have been affected" and recommends log review. URL-decode each access-log request line (up to two passes) and look for .. immediately next to /, \ or ::. Or run Atlassian's regex over the raw lines. Pay most attention to matching requests that got 200 responses. If you find any, assume the files they targeted were read, find out what those files contain, and rotate any credentials or keys among them. The watchTowr script is a quick way to confirm your own instance is no longer vulnerable once patched.

Timeline#

• Oct 5, 2026 — Atlassian publishes the advisory and fixed versions. The CVE record is published.
• Oct 6, 2026 — watchTowr publishes a public detection script for Jira, Confluence and Bitbucket.
• Oct 15, 2026 — CISA adds CVE-2026-21589 to KEV, with a federal due date of Oct 18.

Vulnerability records

• CVE-2026-21589 · KEV 2026-10-15 · This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Atlassian — CVE-2026-21589: Arbitrary File Access Vulnerability impacts Multiple Products confluence.atlassian.com
2. NVD — CVE-2026-21589 nvd.nist.gov
3. CVE.org — CVE-2026-21589 cve.org
4. CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-21589) cisa.gov
5. watchTowr Labs — CVE-2026-21589 detection artifact generator (GitHub) github.com