On October 5, 2026, Atlassian published an advisory about CVE-2026-21589, a critical arbitrary file access vulnerability. The company rates it 9.3 under CVSS 4.0. It affects eight products hosted on organizations’ own infrastructure.
What an attacker can do
An attacker without an account can access specific files within the web application’s root directory. The attacker must already know the exact file name and path; the vulnerability does not allow file enumeration or directory listing. In some configurations, this directory may contain sensitive information.
This is not confirmed code execution through this vulnerability, nor unrestricted access to every file on the server.
Affected products and fixed versions
Atlassian’s advisory lists the following fixed versions as of October 6, 2026. Installations preceding the fixed versions are affected; choose the appropriate version for your branch and check upgrade requirements.
| Product | Fixed versions |
|---|---|
| Bitbucket Data Center | 9.4.26, 10.2.8, 10.5.1 |
| Confluence Data Center | 9.2.26, 10.2.19 |
| Jira Service Management Data Center | 5.12.40, 10.3.26, 11.3.12 |
| Jira Software Data Center | 9.12.40, 10.3.26, 11.3.12 |
| Bamboo Data Center | 10.2.24, 12.1.12 |
| Crowd Data Center | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Crucible | 4.9.15 |
| Fisheye | 4.9.15 |
For Crowd 7.1, the main advisory lists 7.1.7. The Hacker News notes inconsistencies between some tickets and the CVE record; consult the current advisory before installation. End-of-support Server editions require a separate assessment of remediation options.
Recommendations for administrators
- Inventory every instance and create backups before upgrading.
- Install a fixed version as soon as possible, preferably a fixed LTS version or later, following Atlassian’s guidance.
- If an immediate upgrade is not possible, restrict internet access, including to instances that require authentication.
- Apply the temporary rules in the official advisory at the WAF or reverse proxy layer. Atlassian also provides specific instructions for Tomcat and Bitbucket; apply them to every relevant node.
- Review access logs for suspicious path traversal requests, including URL-encoded forms, following the vendor’s instructions.
Temporary mitigations do not replace patching. A suspicious log entry alone does not prove that a file was read; investigation must consider responses and system configuration.
What is known about exploitation
Atlassian states that its affected cloud products have already been patched and its investigation has found no evidence of exploitation in that context. Cloud customers need take no action. This does not confirm that self-hosted instances are uncompromised; organizations must check their own systems.
For infrastructure assessment and security prioritization, contact CyberSec Intelligence.
Sources: Official Atlassian advisory and The Hacker News.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
