Atlassian’s Critical Data Center Flaw at a Glance: A Patch Checklist for Jira, Confluence and Bitbucket
CVE-2026-21589 lets unauthenticated attackers read specific files on self-hosted Atlassian Data Center products. Here are the fixed versions and a checklist for admins.
Teams that run Jira, Confluence or Bitbucket on their own servers have a new critical update to schedule. This week Atlassian disclosed CVE-2026-21589, an arbitrary file-access bug in several self-hosted Data Center products. Cloud customers are already covered. Everyone else should work through the sheet below.
Spec sheet
- Identifier: CVE-2026-21589, rated critical.
- Type: Arbitrary file access within the application’s web root directory.
- Login needed? No. An unauthenticated attacker can exploit it.
- Key limitation: The attacker must already know a target file’s exact name and path. The bug does not let them list or browse directories.
- Scope: Self-hosted Data Center editions. Atlassian Cloud has been patched automatically.
- Exploitation so far: Atlassian says it has no evidence of attacks, but cannot tell whether any individual customer instance has been compromised.
Versions that contain the fix
Every release older than the builds below is affected.
- Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1
- Confluence Data Center: 9.2.26, 10.2.19
- Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12
- Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12
- Bamboo Data Center: 10.2.24, 12.1.12
- Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4
- Crucible and Fisheye: 4.9.15
Admin checklist
- List every self-hosted Atlassian product you run, including Bamboo, Crowd, Crucible and Fisheye, which are easy to forget.
- Upgrade each one to a fixed build on its release line.
- If you can’t patch right away, cut off external network access, even for internet-facing instances that already require a login.
- As a stopgap, apply Atlassian’s temporary mitigations: a WAF or proxy rule blocking the listed traversal patterns, Tomcat RewriteValve rules for Confluence, Jira, Jira Service Management, Bamboo and Crowd, or a URL rewrite rule for Bitbucket.
- Apply any mitigation to every cluster node, including Bitbucket mirrors and mirror farm nodes.
- Search access logs for the traversal patterns described in Atlassian’s bulletin.
- If anything looks off, bring in your security team or provider to investigate.
BleepingComputer’s Bill Toulas reported the advisory and the full version list, and Atlassian’s own bulletin has step-by-step mitigation instructions.
What this means for your company
- Cloud or self-hosted? If your team uses Atlassian in the cloud, no action is needed. If someone runs it on a server in your office or data center, this one is on you.
- “No exploitation yet” is a window, not a guarantee. Critical bugs in popular collaboration tools tend to attract attackers quickly once details circulate.
- Think about what lives in the web root. Configuration files can hold secrets. Rotating any credentials stored there after patching is a sensible precaution.
Need help patching self-hosted collaboration tools without disrupting your teams? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
