CVE-2026-21589 is a critical (CVSS 9.3) arbitrary file access vulnerability in self-hosted Atlassian Data Center products, including Jira, Confluence and Bitbucket. An attacker with no account can read specific files from the application's web root if they know the file's exact path. Atlassian published the advisory on 5 October 2026, attacks were seen within days, and the fix is to upgrade to a patched version. Atlassian Cloud is already patched and cloud customers don't need to do anything.
This guide summarises the official advisory, explains the bug in plain English, lists the fixed versions, and walks through Atlassian's temporary mitigations. It also includes a small Python script, tested on sample logs, that uses Atlassian's own blocking pattern to flag suspicious requests in your access logs.
According to Atlassian's security advisory, released on 5 October 2026, the flaw is described like this: "This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be sensitive files present that increase your risk."
Atlassian rates it Critical, 9.3, with the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H. In plain terms: it's attackable over the network, it's easy to trigger, it needs no login and no user interaction, and it can expose confidential data, with high impact on connected systems.
All versions before the fixed releases of these eight self-hosted products are affected:
The CVE record notes when the bug was introduced in each product, which shows how old it is: for example Confluence from 5.10.0, Jira Software from 7.1.0 and Bitbucket from 4.6.0. Versions that have reached end of life may also be affected, so Atlassian recommends moving to a fixed Long Term Support (LTS) release or later.
No action is needed for Cloud. Atlassian says affected Cloud products have been patched and its investigation found no evidence of exploitation there. This vulnerability is a problem for organisations running Jira, Confluence, Bitbucket and the others on their own servers.
From the advisory, upgrade to one of these versions or any later release:
Pick the fixed version on your release line. For example, if you run Confluence 9.2.x, upgrade to at least 9.2.26; if you're on Jira Software 10.3.x, upgrade to 10.3.26 or later.
Yes. Reports from security firms show the gap between disclosure and attack was very short:
watchTowr's head of threat intelligence said most attempts so far involve fingerprinting products and sweeping for common configuration and sensitive files, and that no post-compromise activity had been seen at the time of reporting. Previdian warned that a ready-made scanning template for the popular Nuclei tool would make mass scanning easier. CERT-EU also published an advisory recommending immediate upgrades, starting with internet-facing instances.
Atlassian's issue tracker classifies the bug as path traversal. A web application should only serve files from approved folders. In a path traversal bug, the attacker includes sequences like ../ ("go up one folder") in the URL, often disguised with URL encoding such as %2e%2e for .., so the request escapes the approved area.
Defending against it means never building file paths directly from user input, normalising paths before checking them, and rejecting anything outside an allowed directory. The same principle applies to your own code whenever you handle filenames, as in my guide to PHP file upload validation.
"Read specific files" sounds limited, especially since the attacker can't list folders. But Java web applications like Jira and Confluence keep important configuration in well-known places, so attackers know exactly what to ask for. Reports citing The Hacker News say that on Jira and Crowd, an attacker could read crowd.properties, which contains credentials for Atlassian Crowd (the component that manages users and logins). Those credentials could then be used to gain administrator access.
Jira and Confluence also often hold sensitive internal information: project plans, incident notes, documentation and source code links. That's why Atlassian's self-hosted products are a frequent target.
Atlassian's advisory gives these options. They're stop-gaps, not replacements for upgrading:
.. next to /, \ or ::, including URL-encoded forms.RewriteValve in the application's <Context> and add Atlassian's rewrite.config rules in the WEB-INF directory, on every node of the cluster, after taking a backup.app/WEB-INF/urlrewrite.xml, including on mirrors and mirror farm nodes.Copy the exact rules from the advisory itself rather than from third-party sites, so you get any updates Atlassian makes.
Before you rely on a WAF rule, test that it blocks the patterns it should and doesn't break normal URLs. Atlassian says to check that your rule blocks .. adjacent to /, \ or :: and handles URL-encoded patterns. I tested the published regex in Python against normal and suspicious-looking paths:
import re
RX = re.compile(r"(?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*")
for path in ["/browse/PROJ-123", "/wiki/spaces/DOC/pages/1/Release+notes", "/download/file.v2..zip",
"/s/../WEB-INF/x", "/s/%2e%2e/x", "/s/%252e%252e%252fx", "/a/..;/b", "/a\\..\\b"]:
print(("BLOCK" if RX.match(path) else "allow"), path)
Output on Python 3.13:
allow /browse/PROJ-123
allow /wiki/spaces/DOC/pages/1/Release+notes
allow /download/file.v2..zip
BLOCK /s/../WEB-INF/x
BLOCK /s/%2e%2e/x
BLOCK /s/%252e%252e%252fx
BLOCK /a/..;/b
BLOCK /a\..\b
Normal paths pass, including a filename with two dots in the middle. Plain, URL-encoded and double-encoded traversal sequences are blocked. Your WAF's regex engine may behave slightly differently, so repeat the test with your own tooling.
Atlassian advises reviewing access logs for the traversal patterns described in its bulletin. Here's a small script that applies the same regex to the request path in each line of a standard access log:
import re, sys
RX = re.compile(r"(?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*")
REQ = re.compile(r'"(?:GET|POST|HEAD|PUT|DELETE|OPTIONS) (\S+)')
def scan(path):
with open(path, encoding="utf-8", errors="replace") as f:
for n, line in enumerate(f, 1):
m = REQ.search(line)
if m and RX.match(m.group(1)):
print(f"{path}:{n}: {line.strip()}")
for p in sys.argv[1:]:
scan(p)
I ran it on a four-line sample log using documentation IP addresses (python3 atl_logscan.py sample_access.log):
sample_access.log:3: 198.51.100.7 - - [08/Oct/2026:09:13:44 +0000] "GET /s/%2e%2e/WEB-INF/web.xml HTTP/1.1" 200 2048
sample_access.log:4: 198.51.100.7 - - [08/Oct/2026:09:13:45 +0000] "GET /s/..;/x HTTP/1.1" 404 312
Pay most attention to matching requests that returned 200, because that suggests a file was served. Run the script over your Tomcat and reverse proxy access logs from at least early October 2026.
If you find signs of probing that succeeded:
If you're not sure which version you run, check the product's administration screens: in Jira and Confluence, the version is shown in the footer and under the system information page, and Bitbucket shows it in its administration area. Then:
This bug fits a pattern. Recent reporting describes other flaws, including in GeoServer and JFrog Artifactory, being attacked within hours or days of details going public. Once a write-up or a scanning template exists, mass scanning of internet-facing servers starts almost immediately. For self-hosted tools, the safest habit is to keep them off the public internet where possible, behind a VPN or zero-trust gateway, and to keep a tested upgrade process so critical patches go in within days.
A critical arbitrary file access vulnerability in eight self-hosted Atlassian Data Center products. An unauthenticated attacker who knows a file's exact path can read it from the application's web root.
Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo and Crowd Data Center, plus Crucible and Fisheye, in all versions before the fixed releases.
No customer action is needed. Atlassian says Cloud products have been patched and it found no evidence of exploitation there.
Confluence Data Center 9.2.26 or 10.2.19, or any later release. Jira Software's fixed versions are 9.12.40, 10.3.26 and 11.3.12.
Yes. Security firms reported exploitation attempts starting about two hours after technical details were published, mostly scanning for configuration and sensitive files.
Atlassian rates it 9.3 (Critical). It needs no login, and some readable files, such as crowd.properties on Jira and Crowd, can contain credentials that lead to administrator access.
Temporarily. Atlassian lists removing the instance from the internet, a WAF or proxy rule, a Tomcat RewriteValve rule, or a urlrewrite.xml rule for Bitbucket. Upgrading is still required.
Search your access logs for path traversal patterns like .. next to slashes, including URL-encoded forms, using Atlassian's regex. Investigate matching requests that returned HTTP 200.
// note
This is a learning note from studying the web. It is one small topic, written so I can remember it. It is not a course and not a claim that I have finished the subject.
If a sentence is wrong, say so from the contact page and name this title. Drafts never appear here. Related notes, when they exist, are other published posts, and the same sample rule applies to each of them.
A new GhostAction wave is using hijacked maintainer accounts to commit a fake "Security Audit" workflow that steals Actions secrets and every credential in your git history. Here is how the attack works, how to check your repositories (with a tested script), and what to rotate.
The UK government plans to stop under-16s using platforms such as TikTok, Instagram, Snapchat, YouTube, Facebook and X from spring 2027. Here is what the official fact sheet says, how age checks might work, whether adults will need to show ID, and what it means for developers and parents.
On 6 October 2026 ASOS app users received a push notification reading 'ASOS HACKED'. ASOS later confirmed attackers took customer profiles including names, addresses, phone numbers and emails, but not payment details or passwords. Here is a factual timeline and eight practical steps to stay safe.
Fingerprinting identifies your browser from dozens of small details, with no cookie to delete. Here is how it works (with a small tested demo), why "fingerprints are the new cookies" went viral this week, what the ICO says, and what actually helps: browsers, settings, VPNs and incognito.