Atlassian's CVE-2026-21589 hits eight Data Center products, and the fix list is long

By Harry - Published: 7 October 2026

If your engineering organisation runs Jira, Confluence or Bitbucket on its own hardware, this week has a patching chore attached. Atlassian disclosed CVE-2026-21589 on 5 October: an arbitrary file access flaw scored 9.3 that lets someone with no login read files from the web application root, provided they know the exact path and name. The Hacker News has the product list, and Atlassian's own advisory carries the full version table.

Who is affected

Eight Data Center products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. Atlassian says its cloud services were already fixed and that its investigation found no evidence of exploitation there. It cannot say the same for customer-run instances, which is the honest position of any vendor that does not see your logs.

Why "known files only" is cold comfort

The need to know the exact file path sounds like a brake on the attack. It is less of one than it appears. These products ship the same directory layout to everybody, so the paths of configuration files, bundled resources and anything else under the web root are public knowledge to anyone who has installed the software once. Whether a given file is worth reading depends on what your team has dropped in that tree over the years, which is exactly the kind of thing nobody inventories. A stray properties file, an old export, a certificate someone parked there: those are the files an attacker with a path list goes looking for.

It is also a path traversal bug, and attackers have well-worn tooling for those. We would plan on scanners appearing quickly after the details settle.

What to do, in order

• Inventory first. Most organisations have more Atlassian instances than they think: the production Confluence, the old Bamboo nobody retired, the Crowd server behind SSO. Crowd and Bamboo sit close to credentials, so rank them high.
• Patch to the fixed builds listed in the advisory (for example Confluence 9.2.26 or 10.2.19, Jira Software 9.12.40, 10.3.26 or 11.3.12, Crowd 6.3.7, 7.0.3, 7.1.7 or 7.2.4). If you cannot patch today, apply Atlassian's blocking rules at the WAF or reverse proxy to reject path traversal patterns, or use the Tomcat RewriteValve and Bitbucket urlrewrite.xml variants it documents.
• Search the web root for things that should not be there, and move them. This is worth doing even if the bug had never existed.
• Read your access logs back to the start of the year for requests containing encoded dot-segments or backslashes against these hosts. Absence of evidence is only as good as your log retention, so write down how far back you could look.
• Treat anything sensitive that lived under the web root as potentially read if you find matching requests, and rotate it.

Internet-facing Data Center instances are the urgent group; internal-only ones are the same bug with one extra step for the attacker. If you want help working out which of your estate falls into which bucket, email sales@halfteck.com.