Atlassian Patches Critical Flaws in Jira, Confluence, Bitbucket, 5 More Products

Key Takeaways

• Atlassian has issued patches for a critical arbitrary file access vulnerability, CVE-2026-21589, impacting eight of its products.
• The flaw, rated 9.3 CVSS, allows unauthenticated attackers to access specific files within an application’s web root directory.
• Affected products include Jira Software Data Center, Confluence Data Center, Bitbucket Data Center, and several others.
• While exploitation requires precise file path knowledge, Atlassian urges immediate patching for all on-premise deployments.
• Cloud versions have been automatically secured, and no evidence of in-the-wild exploitation has been found.

Atlassian Addresses Critical Arbitrary File Access Flaw Across Multiple Products

Atlassian has released urgent security updates to address a critical arbitrary file access vulnerability, identified as CVE-2026-21589, which affects eight of its widely used products. This flaw, carrying a CVSS score of 9.3, enables unauthenticated attackers to gain unauthorized access to specific files located within the web root directory of vulnerable applications.

The security advisory, issued on October 5, 2026, details the extensive list of impacted products: Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Organizations utilizing these on-premise installations are strongly advised to apply the necessary patches without delay.

The vulnerability exposes files within the web application root directory, bypassing the need for any authentication. However, successful exploitation hinges on an attacker knowing the exact name and path of the target file. The flaw does not permit directory listing or automated discovery of files, a limitation that, while narrowing the attack surface, does not diminish the inherent danger. Atlassian warns that certain configurations might store sensitive data in these accessible locations, potentially amplifying the impact of a successful breach. It is crucial to understand that this vulnerability facilitates file access and should not be interpreted as providing unrestricted access to the entire underlying server filesystem.

Patching and Mitigation Details

Atlassian has clarified that all unpatched versions of the aforementioned products are vulnerable. This includes older installations that may have fallen outside the vendor’s official support window. Organizations managing legacy deployments are therefore advised to upgrade to supported, fixed releases.

Specific fixed versions are available across the product suite. For Jira Software Data Center, the fixed releases are 9.12.40, 10.3.26, and 11.3.12. Jira Service Management Data Center users should upgrade to 5.12.40, 10.3.26, or 11.3.12. Confluence Data Center patches are included in versions 9.2.26 and 10.2.19.

Bitbucket Data Center customers are directed to install 9.4.26, 10.2.8, or 10.5.1. Bamboo Data Center fixes are available in 10.2.24 and 12.1.12. For Crowd Data Center, the advisory lists fixes in 6.3.7, 7.0.3, 7.1.7, and 7.2.4. Finally, users of Crucible and Fisheye should upgrade to version 4.9.15.

Administrators must consult Atlassian’s product advisory to determine the correct upgrade path for each specific installation. Updating one product does not automatically secure other vulnerable deployments. Atlassian recommends installing either a listed fixed release or the latest available version. For organizations unable to patch immediately, removing affected instances from public internet exposure is a critical temporary measure. Atlassian emphasizes that even instances protected by user authentication for normal access still require external restrictions, as the exploit does not necessitate authenticated access.

Temporary mitigation strategies include implementing a web application firewall (WAF) or reverse proxy rule using Atlassian-provided regular expressions. These rules are designed to block traversal patterns involving adjacent dots and path separators, including their encoded variants. Administrators must thoroughly test these implementations to ensure they correctly handle the specified patterns. Another temporary option involves configuring Tomcat’s RewriteValve with Atlassian-supplied rewrite rules. This process requires backing up the instance, stopping each cluster node, enabling the valve, installing the configuration, and then restarting the node. These measures are strictly temporary and are not a substitute for applying the official patches.

Atlassian has confirmed that all affected Cloud products have already been patched, requiring no action from customers. Furthermore, the company’s internal investigation has found no evidence of this vulnerability being actively exploited in the wild.

What You Should Do

• Immediately Apply Patches: Prioritize updating all affected on-premise Atlassian products to the specified fixed versions or the latest releases.
• Review Atlassian Advisories: Consult the official Atlassian security advisories for precise version numbers and upgrade instructions relevant to your specific deployments.
• Isolate Vulnerable Instances: If immediate patching is not feasible, remove affected instances from public internet access by placing them behind firewalls or VPNs.
• Implement Temporary Mitigations: Deploy WAF or reverse proxy rules using Atlassian-provided regular expressions, or configure Tomcat’s RewriteValve as a temporary stopgap measure. Ensure thorough testing of these temporary solutions.
• Audit Sensitive File Locations: Review your application configurations to identify if any sensitive files are stored in locations accessible via the web root directory and relocate them if necessary.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.