Recommended Free Tools
Administrators of affected self-hosted Atlassian products should upgrade to the fixed release for their product branch as soon as possible. Atlassian’s October 5, 2026 advisory describes CVE-2026-21589 as a critical, unauthenticated file-access flaw: an attacker must know the exact path and filename to target, and the flaw does not provide directory listing. If an upgrade is delayed, Atlassian advises restricting external access and using a temporary WAF or proxy rule; neither measure replaces patching.
What CVE-2026-21589 does
Atlassian says an unauthenticated attacker can access specific files within the web application root directory of an affected installation. The attacker must already know the exact target filename and path; Atlassian and the CVE record say the vulnerability does not let an attacker enumerate or list directory contents. Some configurations may contain sensitive files that increase the risk. Atlassian’s security advisory assigns the issue Critical severity and a CVSS 4.0 score of 9.3, an internal Atlassian assessment that organizations should evaluate against their own environments.
As an Amazon Associate I earn from qualifying purchases.
Atlassian published the advisory on October 5, 2026. It says its investigation found no evidence of exploitation; that is the vendor’s finding, not a universal guarantee that no exploitation has occurred.
Am I affected?
The advisory covers self-hosted deployments of the following product families. Atlassian says all versions before the listed fixes are affected, and warns that versions outside support may also be affected. Check every instance and its current product branch against the vendor advisory rather than assuming an unsupported installation is safe.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
- Bitbucket Data Center
- Confluence Data Center
- Jira Service Management Data Center
- Jira Software Data Center
- Bamboo Data Center
- Crowd Data Center
- Crucible
- Fisheye
The CVE record and the Canadian Centre for Cyber Security advisory provide additional product and affected-version details. Atlassian’s fixed-version table is the primary upgrade target; where version-threshold wording differs across sources, use the vendor advisory to confirm your build.
Which Atlassian versions are fixed?
Upgrade to the applicable fixed release below or a later version supported by Atlassian. The correct target depends on the product and branch you currently run.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
| Product | Fixed versions |
|---|---|
| Bitbucket Data Center | 9.4.26, 10.2.8, 10.5.1 |
| Confluence Data Center | 9.2.26, 10.2.19 |
| Jira Service Management Data Center | 5.12.40, 10.3.26, 11.3.12 |
| Jira Software Data Center | 9.12.40, 10.3.26, 11.3.12 |
| Bamboo Data Center | 10.2.24, 12.1.12 |
| Crowd Data Center | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Crucible | 4.9.15 |
| Fisheye | 4.9.15 |
Confirm the release available for your branch and follow Atlassian’s release notes and maintenance procedures. The Atlassian Jira issue record also lists fixed versions for Jira products.
What administrators should do now
- Inventory installations. Identify all self-hosted instances of the listed products, including instances on unsupported branches, and record each installed version.
- Upgrade affected instances. Apply the corresponding fixed release or a later supported version as soon as possible, following the product’s release notes and maintenance process.
- Reduce exposure while preparing an upgrade. If you cannot patch immediately, restrict internet access to the instance where feasible. Atlassian advises limiting access to externally accessible instances, including those protected by user authentication.
- Consider the temporary network rule. Atlassian describes a WAF or proxy rule for affected products intended to block URL patterns where
..is immediately adjacent to/,\or::, including encoded variants. The rule must be implemented for the specific WAF or proxy technology and tested to confirm it blocks the relevant patterns. Do not treat a generic regex as a ready-made configuration for every platform. - Complete the upgrade. Treat exposure restrictions and the network rule only as interim risk reduction. Atlassian explicitly says mitigation is limited and is not a replacement for patching.
Patch now or mitigate temporarily?
| Response | What it accomplishes | Important limitation |
|---|---|---|
| Upgrade to a fixed release | Applies Atlassian’s product-specific fix; this is the required remediation. | Requires the organization’s normal upgrade planning and maintenance process. |
| Restrict internet exposure | Reduces the instance’s reachability while an upgrade is being prepared. | Does not fix the vulnerability and may not suit every deployment. |
| Apply a tested WAF or proxy rule | Can block the URL patterns described by Atlassian as a temporary control. | Implementation is technology-dependent and must be validated; it does not replace patching. |
Does CVE-2026-21589 affect Atlassian Cloud?
Atlassian says affected Cloud products have been patched and Cloud customers do not need to take action. This status is distinct from self-managed Data Center installations, whose administrators should check their versions and apply the relevant fix.
Quick Recap
Best Value
Rank #4
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11"
- Reorder SKU: LOG-100-7CW-PP(Watch-Log)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
